CVE-2020-13970

Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature

published July 28, 2020

CVSS
—
EPSS
1%
Percentile
70.0
In the wild
Unconfirmed
What it is

Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform server.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01287 · 70.0th percentile
Published
2020-07-28T20:24Z
EPSS history
Timeline
  • 28 JUL 20:24Z
    Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature
    cvelistv5