CVE-2021-41188CWE-79

Authenticated Stored XSS in Administration

Medium · published October 26, 2021

CVSS v3.1
5.7
EPSS
1%
Percentile
54.8
In the wild
Unconfirmed
What it is

Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the `.htaccess` file will protect against cross-site scripting in this case. There is also a config for those using nginx as a server. The plugin and the configs can be found on the GitHub Security Advisory page for this vulnerability.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00761 · 54.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-10-26T15:00Z
EPSS history
Timeline
  • 26 OCT 15:00Z
    Authenticated Stored XSS in Administration
    cvelistv5