GHSA-g7w8-pp9w-7p32: 
PHP vulnerability analysis and mitigation

Shopware, an open source eCommerce platform, reported a vulnerability (CVE-2021-32709) where the creation of order credits was not properly validated by Access Control List (ACL) in admin orders. The vulnerability was discovered and disclosed on June 24, 2021, affecting Shopware versions up to 6.4.1.0 (GitHub Advisory).

The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function) with a CVSS 3.1 Base Score of 4.9 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N. The CVSS 2.0 Base Score is 4.0 (Medium) with vector (AV:N/AC:L/Au:S/C:N/I:P/A:N) (NVD).

The vulnerability allows unauthorized access to order credit functionality in the admin interface, potentially leading to integrity issues in order management (GitHub Advisory).

The vulnerability requires high privileges for exploitation but has low attack complexity. It can be exploited through network access without requiring user interaction (NVD).

Users are recommended to update to version 6.4.1.1, which can be obtained through the Auto-Updater or direct download. For older versions (6.1, 6.2, and 6.3), security measures are available via a plugin. For complete functionality, updating to the latest Shopware version is recommended (GitHub Advisory).