CVE-2021-32716

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-863

Affected software

Vendor	Product	Versions
shopware	platform	< 6.4.1.1

References

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-06-2021Vendor Advisory
https://github.com/shopware/platform/commit/b5c3ce3e93bd121324d72aa9d367cb636ff1c0ebPatch, Third Party Advisory
https://github.com/shopware/platform/security/advisories/GHSA-gpmh-g94g-qrhrThird Party Advisory
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-06-2021Vendor Advisory
https://github.com/shopware/platform/commit/b5c3ce3e93bd121324d72aa9d367cb636ff1c0ebPatch, Third Party Advisory
https://github.com/shopware/platform/security/advisories/GHSA-gpmh-g94g-qrhrThird Party Advisory

Timeline

Published: Jun 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-327177.5Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers w CVE-2021-327185.4RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could le CVE-2021-327194.8RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the Rabbi CVE-2021-32725.5jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between th CVE-2021-327205.3Sylius is an Open Source eCommerce platform on top of Symfony. In versions of Sylius prior to 1.9.5 and 1.10.0-RC.1, part of the details (or CVE-2021-327216.1PowerMux is a drop-in replacement for Go's http.ServeMux. In PowerMux versions prior to 1.1.1, attackers may be able to craft phishing links CVE-2021-327226.5GlobalNewFiles is a mediawiki extension. Versions prior to 48be7adb70568e20e961ea1cb70904454a671b1d are affected by an uncontrolled resource CVE-2021-327236.5Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Pr CVE-2021-327249.9check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the [check-spelling actio CVE-2021-327255.3Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, default share permissio CVE-2021-327269.8Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were no CVE-2021-327277.5Nextcloud Android Client is the Android client for Nextcloud. Clients using the Nextcloud end-to-end encryption feature download the public