Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-39y7-ay38-m7dz
Vulnerability ID VCID-39y7-ay38-m7dz
Aliases CVE-2021-37709
GHSA-54gp-qff8-946c
Summary Inclusion of Sensitive Information in Log Files Shopware is an open source eCommerce platform. contain a vulnerability involving an insecure direct object reference of log files of the Import/Export feature. contains a patch.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-639 Authorization Bypass Through User-Controlled Key
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-532 Insertion of Sensitive Information into Log File
System Score Found at
epss 0.00218 https://api.first.org/data/v1/epss?cve=CVE-2021-37709
cvssv3.1 6.5 https://github.com/shopware/platform
generic_textual MODERATE https://github.com/shopware/platform
cvssv3.1 6.5 https://github.com/shopware/platform/commit/a9f52abb6eb503654c492b6b2076f8d924831fec
generic_textual MODERATE https://github.com/shopware/platform/commit/a9f52abb6eb503654c492b6b2076f8d924831fec
cvssv3.1 6.5 https://github.com/shopware/platform/security/advisories/GHSA-54gp-qff8-946c
generic_textual MODERATE https://github.com/shopware/platform/security/advisories/GHSA-54gp-qff8-946c
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2021-37709
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2021-37709
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-37709
https://github.com/shopware/platform
https://github.com/shopware/platform/commit/a9f52abb6eb503654c492b6b2076f8d924831fec
https://github.com/shopware/platform/security/advisories/GHSA-54gp-qff8-946c
CVE-2021-37709 https://nvd.nist.gov/vuln/detail/CVE-2021-37709
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/shopware/platform
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/shopware/platform/commit/a9f52abb6eb503654c492b6b2076f8d924831fec
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/shopware/platform/security/advisories/GHSA-54gp-qff8-946c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-37709
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.44392
EPSS Score 0.00218
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T20:55:29.467255+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/shopware/core/CVE-2021-37709.yml 38.6.0