CVE-2021-32717
mediumpriority · track · 31EPSS 0.015 · 73 %ileEUUSEPSS · scored 2026-10-26
Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility according to the documentation. The visibility must be at the same level as `type`. When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing the private files: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html. Otherwise, update to Shopware 6.4.1.1 or install or update the Security plugin (https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659) and run the command `./bin/console s3:set-visibility` to correct your cloud file visibilities.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-6gr8-c3m5-mvrgExposure of Sensitive Information to an Unauthorized Actor2021-09-08ghsa · osvUS
Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility according to the documentation. The visibility must be at the same level as `type`. When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing the private files: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html. Otherwise, update to Shopware 6.4.1.1 or install or update the Security plugin (https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659) and run the command `./bin/console s3:set-visibility` to correct your cloud file visibilities.
- GHSA-vrf2-xghr-j52vPrivate files publicly accessible with Cloud Storage providers2021-06-28ghsa · osvUS
### Impact Private files publicly accessible with Cloud Storage providers when the hashed URL is known ### Patches We recommend first changing your configuration to set the correct visibility according to the documentation. The visibility must be at the same level as `type`. When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing the private files: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html Otherwise, update to Shopware 6.4.1.1 or install or update the Security plugin (https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659) and run the command `./bin/console s3:set-visibility` to correct your cloud file visibilities
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-06-2021cnnvd
- https://github.com/shopware/platform/commit/ba52f683372b8417a00e9014f481ed3d539f34b3cnnvd
- https://github.com/shopware/platform/security/advisories/GHSA-vrf2-xghr-j52vcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-32717cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021062808cnnvd
- https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-06-2021enisa_euvd
- https://github.com/shopware/platform/commit/ba52f683372b8417a00e9014f481ed3d539f34b3enisa_euvd
- https://github.com/shopware/platform/security/advisories/GHSA-vrf2-xghr-j52venisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan