{"id":"CVE-2021-37708","aliases":["EUVD-2021-1932","GHSA-xh55-2fqp-p775"],"status":"published","title":"Command injection in mail agent settings","description":"Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a command injection vulnerability in mail agent settings. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02359,"percentile":0.83904,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77","CWE-78"],"published":"2021-08-16T19:15:13Z","modified":"2026-10-20T10:53:51Z","fixes":[{"ecosystem":"Packagist","package":"shopware/platform","fixed_in":["6.4.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"shopware/core","fixed_in":["6.4.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"shopware/platform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.4.3.0"},{"fixed":"6.4.3.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"shopware/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.4.3.0"},{"fixed":"6.4.3.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"shopware/platform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.3.1"}]}],"versions":["6.3.0.0","6.3.0.1","6.3.0.2","6.3.1.0","6.3.1.1","6.3.2.0","6.3.2.1","6.3.3.0","6.3.3.1","6.3.4.0","6.3.4.1","6.3.5.0","6.3.5.1","6.3.5.2","6.3.5.3","6.3.5.4","6.4.0.0","6.4.0.0-RC1","6.4.1.0","6.4.1.1","6.4.1.2","6.4.2.0","6.4.2.1","6.4.3.0","v6.0.0+ea2","v6.1.0","v6.1.0-rc1","v6.1.0-rc2","v6.1.0-rc3","v6.1.0-rc4","v6.1.1","v6.1.2","v6.1.3","v6.1.4","v6.1.5","v6.1.6","v6.2.0","v6.2.0-RC1","v6.2.1","v6.2.2","v6.2.3"]},{"source":"osv","ecosystem":"Packagist","package":"shopware/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.3.1"}]}],"versions":["6.3.0.0","6.3.0.1","6.3.0.2","6.3.1.0","6.3.1.1","6.3.2.0","6.3.2.1","6.3.3.0","6.3.3.1","6.3.4.0","6.3.4.1","6.3.5.0","6.3.5.1","6.3.5.2","6.3.5.3","6.3.5.4","6.4.0.0","6.4.0.0-RC1","6.4.1.0","6.4.1.1","6.4.1.2","6.4.2.0","6.4.2.1","6.4.3.0","v6.0.0+ea2","v6.1.0","v6.1.0-rc1","v6.1.0-rc2","v6.1.0-rc3","v6.1.0-rc4","v6.1.1","v6.1.2","v6.1.3","v6.1.4","v6.1.5","v6.1.6","v6.2.0","v6.2.0-RC1","v6.2.1","v6.2.2","v6.2.3"]}],"products":[{"vendor":"runzero","product":"platform"},{"vendor":"shopware","product":"platform"},{"vendor":"shopware","product":"shopware"}],"references":[{"url":"https://github.com/shopware/platform/security/advisories/GHSA-xh55-2fqp-p775","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/shopware/platform/commit/82d8d1995f6ce9054323b2c3522b1b3cf04853aa","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37708","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xh55-2fqp-p775"},{"url":"https://github.com/shopware/platform","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-37708","title":"Command injection in mail agent settings","description":"Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a command injection vulnerability in mail agent settings. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.","status":"published","published":"2021-08-16T19:15:13Z","modified":"2024-08-04T01:23:01.658Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:32:58.359368Z"}],"euvd":[{"id":"EUVD-2021-1932","description":"Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a command injection vulnerability in mail agent settings. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.","status":"published","published":"2021-08-16T19:15:13Z","modified":"2024-08-04T01:23:01Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:24:27.254804Z"}],"ghsa":[{"id":"GHSA-xh55-2fqp-p775","title":"Command injection in mail agent settings","description":"### Impact\nCommand injection in mail agent settings\n\n### Patches\nWe recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview.\n\nhttps://www.shopware.com/en/download/#shopware-6\n\n### Workarounds\nFor older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.\n\nhttps://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659","status":"published","published":"2021-08-30T16:14:09Z","modified":"2023-01-29T05:06:52Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T14:36:26.667347Z"}],"nvd":[{"id":"CVE-2021-37708","description":"Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a command injection vulnerability in mail agent settings. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.","status":"published","published":"2021-08-16T20:15:48.647Z","modified":"2026-06-17T04:01:01.817Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T14:06:56.943671Z"}],"osv":[{"id":"CVE-2021-37708","description":"Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a command injection vulnerability in mail agent settings. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.","status":"published","published":"2021-08-16T20:15:48.647Z","modified":"2026-10-20T10:53:51.687400846Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:20.434873Z"},{"id":"GHSA-xh55-2fqp-p775","title":"Command injection in mail agent settings","description":"### Impact\nCommand injection in mail agent settings\n\n### Patches\nWe recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview.\n\nhttps://www.shopware.com/en/download/#shopware-6\n\n### Workarounds\nFor older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.\n\nhttps://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659","status":"published","published":"2021-08-30T16:14:09Z","modified":"2026-09-10T03:49:15.90614258Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T15:46:59.835583Z"}]}}