CVE-2021-37707CWE-20

Manipulation of product reviews via API

Medium · published August 16, 2021

CVSS v3.1
6.5
EPSS
1%
Percentile
59.0
In the wild
Unconfirmed
What it is

Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability that allows manipulation of product reviews via API. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00890 · 59.0th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2021-08-16T18:55Z
EPSS history
Timeline
  • 16 AUG 18:55Z
    Manipulation of product reviews via API
    cvelistv5