Detections
Analytics

SCA: security update for shopware/platform (GHSA-2p89-5f22-8qvf)

high Tenable Cloud Security Plugin ID 409010

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via
 Store-API. The vulnerability could only be fixed by changing the API system, which involves a non-
 backward-compatible change. Only consumers of the Store-API should be affected by this change. We
 recommend to update to the current version 6.3.5.1. You can get the update to 6.3.5.1 regularly via the
 Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 The
 vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible
 change. Only consumers of the Store-API should be affected by this change. Please check your plugins if
 you have it in use. Detailed technical information can be found in the upgrade information.
 https://github.com/shopware/platform/blob/v6.3.5.1/UPGRADE-6.3.md#6351 ### Workarounds For older versions
 of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of
 functions, we recommend updating to the latest Shopware version.
 https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659 ### For more
 information https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2021
 (CVE-2021-32711)

See Also

https://github.com/advisories/GHSA-2p89-5f22-8qvf

Plugin Details

Severity: High

ID: 409010

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2021-32711

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/8/2021

Vulnerability Publication Date: 6/24/2021

Reference Information

CVE: CVE-2021-32711

cwe: CWE-200