CVE-2017-18357

Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the…

published January 15, 2019

CVSS
—
EPSS
27%
Percentile
98.0
In the wild
Unconfirmed
What it is

Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.27074 · 98.0th percentile
Published
2019-01-15T16:00Z
EPSS history
Timeline
  • 15 JAN 16:00Z
    Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the…
    cvelistv5