Servers and applications
CVE-2020-13970
Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform server.
- Severity
- High 8.8
- Published
- 28 Jul 2020
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 6.2.3
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
ShopwareServers and applications · cpe:a:shopware:shopware |
|