Skip to content

CVE-2017-18357 Shopware XXE Vulnerability

MediumCVSS 6.5 EPSS 27.1% Framework module Public exploit
Published
Updated
Exploit status
Public exploit available
Sign in for asset impact Search another CVE

Description

Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object.

Affected products

ProductAffected versionsFixed in
Shopware(Packagist) < 5.3.4 5.3.4
Shopware(Packagist) = 1.0.2 No fix listed
Shopware(Packagist) = 1.0.8 No fix listed
Shopware(Packagist) = 4.2.0 No fix listed
Shopware(Packagist) = 4.2.0-rc.1 No fix listed
Shopware(Packagist) = 4.2.1 No fix listed
Shopware(Packagist) = 4.2.1.1 No fix listed
Shopware(Packagist) = 4.2.2 No fix listed
Shopware(Packagist) = 4.2.3 No fix listed
Shopware(Packagist) = 4.3.0 No fix listed
Shopware(Packagist) = 4.3.1 No fix listed
Shopware(Packagist) = 4.3.2 No fix listed
Shopware(Packagist) = 4.3.3 No fix listed
Shopware(Packagist) = 4.3.4 No fix listed
Shopware(Packagist) = 4.3.5 No fix listed
Shopware(Packagist) = 4.3.6 No fix listed
Shopware(Packagist) = 4.3.7 No fix listed
Shopware(Packagist) = 5.3.0 No fix listed
Shopware(Packagist) = v5.0.0 No fix listed
Shopware(Packagist) = v5.0.0-BETA1 No fix listed
Shopware(Packagist) = v5.0.0-BETA2 No fix listed
Shopware(Packagist) = v5.0.0-RC1 No fix listed
Shopware(Packagist) = v5.0.0-RC2 No fix listed
Shopware(Packagist) = v5.0.0-RC3 No fix listed
Shopware(Packagist) = v5.0.1 No fix listed
Show 51 more
ProductAffected versionsFixed in
Shopware(Packagist) = v5.0.2 No fix listed
Shopware(Packagist) = v5.0.2-RC1 No fix listed
Shopware(Packagist) = v5.0.3 No fix listed
Shopware(Packagist) = v5.0.3-RC1 No fix listed
Shopware(Packagist) = v5.0.4 No fix listed
Shopware(Packagist) = v5.0.4-RC1 No fix listed
Shopware(Packagist) = v5.1.0 No fix listed
Shopware(Packagist) = v5.1.0-RC2 No fix listed
Shopware(Packagist) = v5.1.0-RC3 No fix listed
Shopware(Packagist) = v5.1.1 No fix listed
Shopware(Packagist) = v5.1.2 No fix listed
Shopware(Packagist) = v5.1.2-RC1 No fix listed
Shopware(Packagist) = v5.1.2-RC2 No fix listed
Shopware(Packagist) = v5.1.3 No fix listed
Shopware(Packagist) = v5.1.3-RC1 No fix listed
Shopware(Packagist) = v5.1.4 No fix listed
Shopware(Packagist) = v5.1.5 No fix listed
Shopware(Packagist) = v5.1.6 No fix listed
Shopware(Packagist) = v5.2.0 No fix listed
Shopware(Packagist) = v5.2.0-BETA1 No fix listed
Shopware(Packagist) = v5.2.0-RC1 No fix listed
Shopware(Packagist) = v5.2.0-RC2 No fix listed
Shopware(Packagist) = v5.2.0-RC3 No fix listed
Shopware(Packagist) = v5.2.1 No fix listed
Shopware(Packagist) = v5.2.10 No fix listed
Shopware(Packagist) = v5.2.11 No fix listed
Shopware(Packagist) = v5.2.12 No fix listed
Shopware(Packagist) = v5.2.13 No fix listed
Shopware(Packagist) = v5.2.14 No fix listed
Shopware(Packagist) = v5.2.15 No fix listed
Shopware(Packagist) = v5.2.16 No fix listed
Shopware(Packagist) = v5.2.17 No fix listed
Shopware(Packagist) = v5.2.18 No fix listed
Shopware(Packagist) = v5.2.19 No fix listed
Shopware(Packagist) = v5.2.2 No fix listed
Shopware(Packagist) = v5.2.20 No fix listed
Shopware(Packagist) = v5.2.21 No fix listed
Shopware(Packagist) = v5.2.22 No fix listed
Shopware(Packagist) = v5.2.23 No fix listed
Shopware(Packagist) = v5.2.24 No fix listed
Shopware(Packagist) = v5.2.25 No fix listed
Shopware(Packagist) = v5.2.26 No fix listed
Shopware(Packagist) = v5.2.27 No fix listed
Shopware(Packagist) = v5.2.3 No fix listed
Shopware(Packagist) = v5.2.4 No fix listed
Shopware(Packagist) = v5.2.5 No fix listed
Shopware(Packagist) = v5.2.6 No fix listed
Shopware(Packagist) = v5.2.7 No fix listed
Shopware(Packagist) = v5.2.8 No fix listed
Shopware(Packagist) = v5.2.9 No fix listed
Shopware < 5.3.4 5.3.4

References