← Back to CVE List

CVE-2017-18357

Published: 2019-01-15T16:29Z
Last Modified: 2024-11-21T03:19Z
Source: MITRE CVE List
License: MITRE-CVE-TOS
Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt