Shopware Information Disclosure Vulnerability in License Management

An information disclosure vulnerability has been identified in Shopware's commercial package, specifically in versions 7.0.0 prior to 7.8.1 and versions prior to 6.10.15. The vulnerability arises because the '/api/_info/config' route exposes sensitive information about activated licenses and features. This could lead to an unwanted exposure of the system's state.

Impact

Exploitation of this vulnerability could result in unauthorized access to license information and features, potentially revealing the system's state and configuration.

Remediation

Users can upgrade to Shopware versions 7.8.1 or 6.10.15 to address this vulnerability.