CVE-2021-41188
lowpriority · track · 22EPSS 0.008 · 55 %ileEUUSEPSS · scored 2026-10-26
Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the `.htaccess` file will protect against cross-site scripting in this case. There is also a config for those using nginx as a server. The plugin and the configs can be found on the GitHub Security Advisory page for this vulnerability.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.5–5.7
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-4p3x-8qw9-24w9Authenticated Stored XSS in shopware/shopware2021-10-27ghsa · osvUS
### Impact Authenticated Stored XSS in Administration ### Patches Use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html ### Workarounds If you cannot use the security plugin, add the following config to your `.htaccess` file ``` <IfModule mod_headers.c> <FilesMatch "\.(?i:svg)$"> Header set Content-Security-Policy "script-src 'none'" </FilesMatch> </IfModule> ``` If you are using nginx as server config, you can add the following to your configuration: ``` server { # ... location ~* ^.+\.svg$ { add_header Content-Security-Policy "script-src 'none'"; } } ``` ### References https://docs.shopware.com/en/shopware-5-en/sicherheitsupdates/security-update-10-2021
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (15)
External citations — patches, advisories, analysis.
- https://docs.shopware.com/en/shopware-5-en/sicherheitsupdates/security-update-10-2021cnnvd
- https://github.com/shopware/shopware/commit/37213e91d525c95df262712cba80d1497e395a58cnnvd
- https://github.com/shopware/shopware/releases/tag/v5.7.6cnnvd
- https://github.com/shopware/shopware/security/advisories/GHSA-4p3x-8qw9-24w9cnnvd
- https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.htmlcnnvd
- https://docs.shopware.com/en/shopware-5-en/sicherheitsupdates/security-update-10-2021enisa_euvd
- https://github.com/shopware/shopware/commit/37213e91d525c95df262712cba80d1497e395a58enisa_euvd
- https://github.com/shopware/shopware/releases/tag/v5.7.6enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan