high7.5
CVE-2020-13997
Shopware database password is leaked to an unauthenticated users
Impact
In Shopware 6 before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled. This vulnerability does not affect the shopware 5 release branch (`shopware/shopware` on packagist).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | shopware/core | >= 6.0.0, < 6.2.3 | 6.2.3 |
| composer | shopware/platform | >= 6.0.0, < 6.2.3 | 6.2.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Shopware | Shopware | before 6.2.3 |