Shopware 6.5.0.0 Release Candidate 3
Approved changes feed: RSS · Atom
cpe:2.3:a:shopware:shopware:6.5.0.0:rc3:*:*:*:*:*:*
part: a version: 6.5.0.0 update: rc3
| Vendor | Shopware (03d0634f-d86e-5a60-ad92-ec84f39a59ef) |
|---|---|
| Product | Shopware (8a34e4a1-8d42-5a90-ab0f-bdb02362a824) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/shopware/platform |
purl2cpe | 2026-06-01 10:14:40.653486 |
pkg:shopware/shopware-6 |
purl2cpe | 2026-06-01 10:14:40.653487 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-2017 |
vulnerable | 2026-06-08 06:02:41.222859 |
Improper Control of Generation of Code in Twig Rendered Views in Shopware
HIGH (8.8)
Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in `Shopware\Core\Framework\Adapter\Twig\SecurityExtension` and call any arbitrary PHP function and thus execute arbitrary code/commands via usage of fully-qualified names, supplied as array of strings, when referencing callables. Users are advised to upgrade to v6.4.20.1 to resolve this issue. This is a bypass of CVE-2023-22731.
Published: 2023-04-17T10:18:27.543Z
Updated: 2025-02-05T20:46:43.936Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.