CVE-2020-13970

2020-07-2821:15:14

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.8%

JSON

Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its “Mediabrowser upload by URL” feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform server.

CPENameOperatorVersion
platformeq6.1.0-rc1
platformeq6.1.0-rc2
platformeq6.1.0-rc4
platformeq6.0.0+ea1.1
platformeq6.2.1
platformeq6.1.5
platformeq6.1.0-rc3
platformeq6.1.4
platformeq6.0.0+ea1
platformeq6.0.0+dp1

Name	Operator	Version
platform	eq	6.1.0-rc1
platform	eq	6.1.0-rc2
platform	eq	6.1.0-rc4
platform	eq	6.0.0+ea1.1
platform	eq	6.2.1
platform	eq	6.1.5
platform	eq	6.1.0-rc3
platform	eq	6.1.4
platform	eq	6.0.0+ea1
platform	eq	6.0.0+dp1