CVE-2021-32709CWE-306

Creation of order credits was not validated by acl in admin orders

Medium · published June 24, 2021

CVSS v3.1
4.9
EPSS
1%
Percentile
49.3
In the wild
Unconfirmed
What it is

Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to update to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00626 · 49.3th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2021-06-24T18:50Z
EPSS history
Timeline
  • 24 JUN 18:50Z
    Creation of order credits was not validated by acl in admin orders
    cvelistv5