In short
- CVE-2020-13970 is a HIGH (CVSS 8.8) vulnerability affecting shopware/platform, shopware (shopware).
- Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 70.2% of all vulnerabilities.
- Fix: update to 6.2.3 or later.
Description
Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform server.
NVD description
Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform server.
More vulnerabilities in shopware/platform
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free