Authenticated Stored XSS in shopware/shopware

MOYENNE 5.4CVE-2021-41188 · GHSA-4p3x-8qw9-24w9 · Published 26/10/2021 · updated 17/06/2026

En bref

CVE-2021-41188 est une vulnérabilité MOYENNE (CVSS 5.4) touchant shopware/shopware, shopware (shopware).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.76%, plus élevée que 55.3% des vulnérabilités.
Correctif : mettre à jour vers 5.7.6 ou plus récent.

Package	Affected versions	Patched versions
shopware/shopware Packagist	`< 5.7.6`	`5.7.6`
shopware shopware	`< 5.7.6`	`5.7.6`

Description

Impact

Authenticated Stored XSS in Administration

Patches

Use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

Workarounds

If you cannot use the security plugin, add the following config to your .htaccess file

<IfModule mod_headers.c>
    <FilesMatch "\.(?i:svg)$">
        Header set Content-Security-Policy "script-src 'none'"
    </FilesMatch>
</IfModule>

If you are using nginx as server config, you can add the following to your configuration:

server {
    # ...

    location ~* ^.+\.svg$ {
        add_header Content-Security-Policy "script-src 'none'";
    }
}

References

https://docs.shopware.com/en/shopware-5-en/sicherheitsupdates/security-update-10-2021

NVD description

Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the `.htaccess` file will protect against cross-site scripting in this case. There is also a config for those using nginx as a server. The plugin and the configs can be found on the GitHub Security Advisory page for this vulnerability.

References

shopware/shopware security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-41188 · ADVISORY
shopware/shopware commit 37213e9 · WEB
docs.shopware.com/en/shopware-5-en/sicherheitsupdates/security-update-10-2021 · WEB
shopware/shopware · PACKAGE
shopware/shopware release v5.7.6 · WEB
store.shopware.com/en/swag575294366635f/shopware-security-plugin.html · WEB

Autres vulnérabilités de shopware/shopware

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

shopware/shopware

Packagist

< 5.7.6

5.7.6

shopware

< 5.7.6

5.7.6

Description

Impact

Authenticated Stored XSS in Administration

Patches

Use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

Workarounds

If you cannot use the security plugin, add the following config to your .htaccess file

<IfModule mod_headers.c>
    <FilesMatch "\.(?i:svg)$">
        Header set Content-Security-Policy "script-src 'none'"
    </FilesMatch>
</IfModule>

If you are using nginx as server config, you can add the following to your configuration:

server {
    # ...

    location ~* ^.+\.svg$ {
        add_header Content-Security-Policy "script-src 'none'";
    }
}

References

https://docs.shopware.com/en/shopware-5-en/sicherheitsupdates/security-update-10-2021

NVD description

Autres vulnérabilités de shopware/shopware

Tout voir →