CVE-2020-13997: Shopware database password leakage
Summary
CVE-2020-13997: Shopware database password is leaked to an unauthenticated users. Affects shopware/core versions >= 6.0.0, < 6.2.3. Fixed in 6.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Shopware is an open-source e-commerce platform that provides a range of features for online stores. It is widely used for building and managing online shops. The Shopware core, Shopware platform, and Shopware shopware packages are integral components of the Shopware ecosystem.
Vulnerability Detail
In Shopware before version 6.2.3, an unauthenticated user can obtain the database password when a DriverException occurs and verbose error handling is enabled. This vulnerability poses a significant risk as it allows unauthorized access to the database, potentially leading to data theft, modification, or unauthorized actions.
How To Fix
Minimum fixed version
6.2.3
This is the first release that contains the fix.
composer require shopware/core:6.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by upgrading to Shopware version 6.2.3 or later.
Conclusion
The Shopware database password leakage vulnerability (CVE-2020-13997) allows unauthenticated users to obtain the database password, posing a significant risk to the security of Shopware installations. It is crucial to upgrade to Shopware version 6.2.3 or later to fix this vulnerability and prevent unauthorized access to the database. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for shopware/core →
FAQ
This vulnerability allows unauthenticated users to obtain the database password, potentially leading to unauthorized access, data theft, or modification.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Shopware installation is affected by this vulnerability. It analyzes your composer.lock file and provides real-time alerts for open-source vulnerabilities.
Yes, all versions of Shopware before 6.2.3 are affected by this vulnerability. It is crucial to upgrade to the fixed version to mitigate the risk.
Yes, the fix for this vulnerability is included in Shopware version 6.2.3. It is recommended to upgrade to this version or later to apply the patch.
Yes, an attacker can exploit this vulnerability remotely without authentication. They can obtain the database password by triggering a DriverException and enabling verbose error handling.
Related vulnerabilities
Recent vulnerabilities recorded for shopware/core.
