GHSA-vrf2-xghr-j52v

    Dashboard / Vulnerabilities / GHSA-vrf2-xghr-j52v

    GHSA-vrf2-xghr-j52v

    Published: 28 Jun 2021Last Modified: 10 Sept 2026

    Summary: Private files publicly accessible with Cloud Storage providers

    Details: ### Impact Private files publicly accessible with Cloud Storage providers when the hashed URL is known ### Patches We recommend first changing your configuration to set the correct visibility according to the documentation. The visibility must be at the same level as `type`. When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing the private files: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html Otherwise, update to Shopware 6.4.1.1 or install or update the Security plugin (https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659) and run the command `./bin/console s3:set-visibility` to correct your cloud file visibilities

    References: https://github.com/shopware/platform/security/advisories/GHSA-vrf2-xghr-j52v, https://github.com/shopware/platform

    Affected packages

    Package

    Name: shopware/platform

    Purl: pkg:composer/shopware/platform

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -6.4.1.1

    Affected versions

    6.3.0.0
    6.3.0.1
    6.3.0.2
    6.3.1.0
    6.3.1.1
    6.3.2.0
    6.3.2.1
    6.3.3.0
    6.3.3.1
    6.3.4.0
    6.3.4.1
    6.3.5.0
    6.3.5.1
    6.3.5.2
    6.3.5.3
    6.3.5.4

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-vrf2-xghr-j52v | CVE-DB