GHSA-3pcr-4982-548m
Suggest an improvement- Source
- https://github.com/advisories/GHSA-3pcr-4982-548m
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-3pcr-4982-548m/GHSA-3pcr-4982-548m.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-3pcr-4982-548m
- Published
- 2021-04-13T15:13:37Z
- Modified
- 2024-12-02T05:41:34.390456Z
- Summary
- Exposure of .env if project root is configured as web root in shopware/production
- Details
-
Impact
The .env and other sensitive files can be leaked if the project root and not
/publicis configured as the web root.Patches
We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/download/#shopware-6
Workarounds
You should always use
/publicas the web root.For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2021
- Database specific
{ "nvd_published_at": null, "cwe_ids": [ "CWE-552" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2021-04-12T22:33:05Z" }- References
Affected packages
Packagist / shopware/production
Package
- Name
- shopware/production
- Purl
- pkg:composer/shopware/production
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed6.3.5.3