github.com
https://github.com/shopware/shopware GHSA-68WV-G3FW-PQ7Q
Shopware Broken ACL on Document retrieval to access other customers documents
Description
### Impact It's possible to guess the deepLinkCode of an Document to open documents of other customers ### Patches Update to Shopware 6.6.10.3 or 6.5.8.17 ### Workarounds For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Description source: GitHub Advisory
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
shopware/coreBrowse Packagist / shopware/core | GitHub Advisory | 6.6.0.0 to < 6.6.10.3 · Fixed in 6.6.10.3 | affected |
| 6.7.0.0-rc1 to < 6.7.0.0-rc2 · Fixed in 6.7.0.0-rc2 | affected | ||
| Before 6.5.8.17 · Fixed in 6.5.8.17 | affected | ||
shopware/platformBrowse Packagist / shopware/platform | GitHub Advisory | 6.6.0.0 to < 6.6.10.3 · Fixed in 6.6.10.3 | affected |
| 6.7.0.0-rc1 to < 6.7.0.0-rc2 · Fixed in 6.7.0.0-rc2 | affected | ||
| Before 6.5.8.17 · Fixed in 6.5.8.17 | affected |
References
5github.com
https://github.com/shopware/shopware/releases/tag/v6.5.8.17 github.com
https://github.com/shopware/shopware/releases/tag/v6.6.10.3 github.com
https://github.com/shopware/shopware/releases/tag/v6.7.0.0-rc2 github.com
https://github.com/shopware/shopware/security/advisories/GHSA-68wv-g3fw-pq7q