| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| shopware/core | ≥ 6.7.0.0, < 6.7.3.1< 6.6.10.7 | 6.7.3.16.6.10.7 |
| shopware/platform | ≥ 6.7.0.0, < 6.7.3.1< 6.6.10.7 | 6.7.3.16.6.10.7 |
Refunds in general can be enabled through the administration setting core.cart.enableOrderRefunds (in the cart panel).Which visually shows and hides the button. However, using a custom crafted request, a customer can still cancel his own orders.As this is not checked inside the route (and also not in the controller):
https://github.com/shopware/shopware/blob/trunk/src/Storefront/Controller/AccountOrderController.php#L98
https://github.com/shopware/shopware/blob/trunk/src/Core/Checkout/Order/SalesChannel/CancelOrderRoute.php
To mitigate this, a check should be added to the CancelOrderRoute which verifies that the feature is enabled.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン