GHSA-jvg4-9rc2-wvcr: 
PHP vulnerability analysis and mitigation

A security vulnerability was identified in Shopware platform versions from 6.1.0 up to and including 6.3.5.0, allowing the generation of fake documents via public GET-call. The vulnerability was disclosed in February 2021 and assigned the identifier GHSA-jvg4-9rc2-wvcr (GitHub Advisory, Shopware Docs).

The vulnerability was classified as having low severity and was associated with CWE-862 (Missing Authorization). The issue allowed unauthorized generation of fake documents through public GET requests (GitHub Advisory).

The vulnerability could potentially allow attackers to generate unauthorized fake documents through the system's public GET endpoints (Shopware Docs).

The vulnerability could be exploited through public GET requests, though specific details about exploitation methods were not publicly disclosed (GitHub Advisory).

The vulnerability was patched in version 6.3.5.1. Users are recommended to update to this version through the Auto-Updater or via the download overview. For older versions (6.1 and 6.2), security measures are available through a plugin, though updating to the latest version is recommended for full functionality (Shopware Docs).