GHSA-pjj4-jjgc-h3r8: 
PHP vulnerability analysis and mitigation

A moderate severity security vulnerability was identified in Shopware Platform (composer package: shopware/platform) affecting versions 6.1.0 through 6.3.5.1. The vulnerability, tracked as GHSA-pjj4-jjgc-h3r8, was discovered and published on March 8, 2021, involving authenticated remote code execution using the plugin manager without proper ACL permissions (GitHub Advisory).

The vulnerability is classified with moderate severity and is associated with CWE-74. The issue specifically relates to the plugin manager functionality where authenticated users could potentially execute remote code without proper ACL permission checks (GitHub Advisory, Shopware Docs).

The vulnerability allows authenticated users to execute remote code through the plugin manager functionality without proper access control list (ACL) permissions, potentially compromising the security of affected Shopware installations (GitHub Advisory).

While specific exploit details are not publicly disclosed, the vulnerability requires authentication to exploit, which somewhat limits its potential impact. The issue was addressed as part of a security update that also fixed potential session hijacking concerns (Shopware Docs).

The vulnerability has been patched in version 6.3.5.2. Users are recommended to update to this version through the Auto-Updater or via the download overview. For older versions (6.1 and 6.2), security measures are available through a dedicated plugin, though updating to the latest Shopware version is recommended for full functionality (GitHub Advisory, Shopware Docs).