-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from email content (including password reset links) being logged without sanitization. The patch modifies template data construction in SendMailAction.php by adding eventName context, but crucially changes how template data is merged before being passed to send(). The original getTemplateData method provided raw sensitive data, and the handle method propagated it to logging via send(). Both functions directly contributed to the improper log neutralization described in CWE-117 and CWE-532.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| shopware/platform | composer | <= 6.4.18.0 | 6.4.18.1 |
| shopware/core | composer | <= 6.4.18.0 | 6.4.18.1 |
Ongoing coverage of React2Shell