### Impact
Authenticated Server Side Request Forgery
### Patches
We recommend to update to the current version 6.3.4.1. You can get the update to 6.3.4.1 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/download/#shopware-6
### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-12-2020
### Credits
We would like to thank <a rel="noopener" href="https://reqon
### Impact
Information exposure via query strings in URL
### Patches
We recommend to update to the current version 6.3.4.1. You can get the update to 6.3.4.1 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/download/#shopware-6
### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-12-2020
### Credits
We would like to thank <a rel="noopener" href="https://
### Impact
Authenticated Privilege Escalation
### Patches
We recommend to update to the current version 6.3.4.1. You can get the update to 6.3.4.1 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/download/#shopware-6
### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-12-2020
### Impact
Denial of Service via Cache Flooding
### Patches
We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/download/#shopware-6
### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-10-2020
### Impact
Authenticated XML External Entity Processing
### Patches
We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/download/#shopware-6
### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-10-2020
### Impact
Non-persistent XSS in the Storefront
### Patches
We recommend to update to the current version 6.3.1.1. You can get the update to 6.3.1.1 regularly via the Auto-Updater or directly via the download overview.
For older versions you can use the Security Plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
### References
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-09-2020
### Impact
RCE in Third Party Library
### Patches
We recommend to update to the current version 6.3.1.1. You can get the update to 6.3.1.1 regularly via the Auto-Updater or directly via the download overview.
For older versions you can use the Security Plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
### References
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-09-2020
Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform server.
In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication.
In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled.