CVE-2017-18357
N/A
Published: January 15, 2019 at 04:00 PM UTC
Updated: June 17, 2026 at 01:12 AM UTC
1 product affected across 1 vendorShopware
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 27%
Description
Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Shopware· Shopwarecomposer
95%v < 5.3.4
Affected range stops below 5.3.4, so it looks safe — our inference, not a vendor statement
Remediation
No guide yetNo remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.
References (3)
x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://blog.ripstech.com/2017/shopware-php-object-instantiation-to-blind-xxe/x_refsource_MISCThird Party Advisory
Source: [email protected]
https://demo.ripstech.com/projects/shopware_5.3.3Quick Info
StatusMODIFIED
CWE
CWE-610
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card