### Impact
Denial of Service via Cache Flooding
### Patches
We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/download/#shopware-6
### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-10-2020
### Impact
Authenticated XML External Entity Processing
### Patches
We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/download/#shopware-6
### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-10-2020
### Impact
Non-persistent XSS in the Storefront
### Patches
We recommend to update to the current version 6.3.1.1. You can get the update to 6.3.1.1 regularly via the Auto-Updater or directly via the download overview.
For older versions you can use the Security Plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
### References
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-09-2020
### Impact
RCE in Third Party Library
### Patches
We recommend to update to the current version 6.3.1.1. You can get the update to 6.3.1.1 regularly via the Auto-Updater or directly via the download overview.
For older versions you can use the Security Plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
### References
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-09-2020
In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled.