CVE-2021-32717

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility according to the documentation. The visibility must be at the same level as `type`. When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing the private files: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html. Otherwise, update to Shopware 6.4.1.1 or install or update the Security plugin (https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659) and run the command `./bin/console s3:set-visibility` to correct your cloud file visibilities.

• CWE-200
• CWE-732

• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-06-2021Patch, Vendor Advisory
• https://github.com/shopware/platform/commit/ba52f683372b8417a00e9014f481ed3d539f34b3Patch, Third Party Advisory
• https://github.com/shopware/platform/security/advisories/GHSA-vrf2-xghr-j52vThird Party Advisory
• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-06-2021Patch, Vendor Advisory
• https://github.com/shopware/platform/commit/ba52f683372b8417a00e9014f481ed3d539f34b3Patch, Third Party Advisory
• https://github.com/shopware/platform/security/advisories/GHSA-vrf2-xghr-j52vThird Party Advisory

Published

Jun 24, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32711Shopware is an open source eCommerce platform. Versions prio…7.5
• CVE-2021-32712Shopware is an open source eCommerce platform. Versions prio…5.3
• CVE-2021-32713Shopware is an open source eCommerce platform. Versions prio…4.8
• CVE-2021-32714hyper is an HTTP library for Rust. In versions prior to 0.14…9.1
• CVE-2021-32715hyper is an HTTP library for rust. hyper's HTTP/1 server cod…5.3
• CVE-2021-32716Shopware is an open source eCommerce platform. In versions p…4.9
• CVE-2021-32718RabbitMQ is a multi-protocol messaging broker. In rabbitmq-s…5.4
• CVE-2021-32719RabbitMQ is a multi-protocol messaging broker. In rabbitmq-s…4.8
• CVE-2021-3272jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 ha…5.5
• CVE-2021-32720Sylius is an Open Source eCommerce platform on top of Symfon…5.3
• CVE-2021-32721PowerMux is a drop-in replacement for Go's http.ServeMux. In…6.1
• CVE-2021-32722GlobalNewFiles is a mediawiki extension. Versions prior to 4…6.5