Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag
Résumé
Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Shopware, an open ecommerce platform, has a new Twig Tag sw_silent_feature_call which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- patch github.com
- patch github.com