CVE-2017-18357

Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction method of the ShopwareControllersBackendProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object...

PT-2019-8297 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 5.3.4 Description: The issue is related to a PHP Object Instantiation problem. It can be triggered via the sort parameter to the loadPreviewAction method of the Shopware Controllers Backend ProductStream controller...