GHSA-7cw6-7h3h-v8pf
Shopware Has Improper Control of Generation of Code in Twig rendered views
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | shopware/shopware | >= 6.7.0.0, < 6.7.6.1 | 6.7.6.1 |
| Packagist | shopware/core | >= 6.7.0.0, < 6.7.6.1 | 6.7.6.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
We fixed with [CVE-2023-2017](https://github.com/advisories/GHSA-7v2v-9rm4-7m8f) Twig filters to only be executed with allowed functions. However there was a regression that lead to an array and array crafted PHP Closure not checked being against allow list for the map(...) override
### Patches
Patched in 6.7.6.1
### Workarounds
Install the security plugin
References
External links from the advisory. They lead to third-party sites.