| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| shopware/core | ≥ 6.6.0.0, < 6.6.10.3≥ 6.7.0.0-rc1, < 6.7.0.0-rc2< 6.5.8.18 | 6.6.10.36.7.0.0-rc26.5.8.18 |
| shopware/platform | ≥ 6.6.0.0, < 6.6.10.3≥ 6.7.0.0-rc1, < 6.7.0.0-rc2< 6.5.8.18 | 6.6.10.36.7.0.0-rc26.5.8.18 |
| shopware | = 6.7.0.0≥ 6.6.0.0, < 6.6.10.3< 6.5.8.18 | 6.6.10.36.5.8.18 |
Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop.
Using the store-api endpoint /store-api/account/recovery-password you get the response
{"errors":[{"status":"404","code":"CHECKOUT__CUSTOMER_NOT_FOUND","title":"Not Found","detail":"No matching customer for the email \[email protected]\u0022 was found.","meta":{"parameters":{"email":"[email protected]"}}}]}
which indicates clearly that there is no account for this customer. In contrast you get a success response if the account was found.
Update to Shopware 6.6.10.3
For older versions of 6.5 or 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí