CVE-2016-3109 Shopware RCE Vulnerability
CriticalCVSS 9.8
EPSS 28.1%
Public exploit
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Shopware(Packagist) | < 4.3.7 | 4.3.7 |
| Shopware(Packagist) | = 1.0.2 | No fix listed |
| Shopware(Packagist) | = 1.0.8 | No fix listed |
| Shopware(Packagist) | = 4.2.0 | No fix listed |
| Shopware(Packagist) | = 4.2.0-rc.1 | No fix listed |
| Shopware(Packagist) | = 4.2.1 | No fix listed |
| Shopware(Packagist) | = 4.2.1.1 | No fix listed |
| Shopware(Packagist) | = 4.2.2 | No fix listed |
| Shopware(Packagist) | = 4.2.3 | No fix listed |
| Shopware(Packagist) | = 4.3.0 | No fix listed |
| Shopware(Packagist) | = 4.3.1 | No fix listed |
| Shopware(Packagist) | = 4.3.2 | No fix listed |
| Shopware(Packagist) | = 4.3.3 | No fix listed |
| Shopware(Packagist) | = 4.3.4 | No fix listed |
| Shopware(Packagist) | = 4.3.5 | No fix listed |
| Shopware(Packagist) | = 4.3.6 | No fix listed |
| Shopware(Packagist) | >= 5.0.0, < 5.1.5 | 5.1.5 |
| Shopware(Packagist) | = v5.0.0 | No fix listed |
| Shopware(Packagist) | = v5.0.1 | No fix listed |
| Shopware(Packagist) | = v5.0.2 | No fix listed |
| Shopware(Packagist) | = v5.0.2-RC1 | No fix listed |
| Shopware(Packagist) | = v5.0.3 | No fix listed |
| Shopware(Packagist) | = v5.0.3-RC1 | No fix listed |
| Shopware(Packagist) | = v5.0.4 | No fix listed |
| Shopware(Packagist) | = v5.0.4-RC1 | No fix listed |
Show 11 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Shopware(Packagist) | = v5.1.0 | No fix listed |
| Shopware(Packagist) | = v5.1.0-RC2 | No fix listed |
| Shopware(Packagist) | = v5.1.0-RC3 | No fix listed |
| Shopware(Packagist) | = v5.1.1 | No fix listed |
| Shopware(Packagist) | = v5.1.2 | No fix listed |
| Shopware(Packagist) | = v5.1.2-RC1 | No fix listed |
| Shopware(Packagist) | = v5.1.2-RC2 | No fix listed |
| Shopware(Packagist) | = v5.1.3 | No fix listed |
| Shopware(Packagist) | = v5.1.3-RC1 | No fix listed |
| Shopware(Packagist) | = v5.1.4 | No fix listed |
| Shopware | <= 5.1.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- community.shopware.com
- github.com exploit
- web.archive.org
- web.archive.org
- packetstormsecurity.com exploit patch third-party-advisory vdb-entry
- github.com
- 20160423 Remote Code Execution in Shopware <5.1.5 (CVE-2016-3109) mailing-list
- 97979 third-party-advisory vdb-entry