CVE-2020-13997: Shopware database password is leaked to an unauthenticated users
In Shopware 6 before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled. This vulnerability does not affect the shopware 5 release branch (shopware/shopware on packagist).
Other sources
In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled.
— MITRE
Shopware database password is leaked to an unauthenticated users
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/shopware/platformto a version that resolves this vulnerability.Fixed in 6.2.3 - Upgrade
Upgrade
composer/shopware/coreto a version that resolves this vulnerability.Fixed in 6.2.3 - Upgrade
Upgrade
Shopwareto a version that resolves this vulnerability.Fixed in 6.2.3
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-13997.
What is the severity of CVE-2020-13997?
The severity of CVE-2020-13997 is high with a severity value of 7.5.
What is the description of CVE-2020-13997?
The description of CVE-2020-13997 is that in Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled.
How does CVE-2020-13997 affect Shopware?
CVE-2020-13997 affects Shopware versions up to and including 6.2.3.
How can I fix CVE-2020-13997?
To fix CVE-2020-13997, you should update to Shopware version 6.2.3 or later.