CVE-2020-13997

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.2.3

Description The database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled. This issue does not affect the Shopware 5 release branch.

Recommendations For versions prior to 6.2.3, update to version 6.2.3 or later to resolve the issue. As a temporary workaround, consider disabling verbose error handling until a patch is available. Restrict access to error logs to minimize the risk of exploitation.