CVE-2020-13997: Information Exposure Through an Error Message

July 28, 2020 (updated July 21, 2021)

In Shopware, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled.

References

docs.shopware.com/en/shopware-6-en/security-updates/security-update-07-2020
nvd.nist.gov/vuln/detail/CVE-2020-13997
www.shopware.com/en/changelog/

Code Behaviors & Features

Detect and mitigate CVE-2020-13997 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →