Reporting vulnerabilities

Have you found a vulnerability in Kaufquelle or Produktpass, or do you suspect one? Please report it to us confidentially before you publish it.

Contact

Write to security@extensionfoundry.com with the subject "Sicherheit Kaufquelle" or "Sicherheit Produktpass".

How to report a vulnerability

1. Name the plugin's version (Plug-ins > Plug-in manager), the version of JTL-Shop and of PHP.
2. Describe what you observed and how it can be reproduced.
3. Do not send any buyer's data, not even order numbers, and no access data.

What happens next

1. You get an acknowledgement within two working days.
2. We check the report and tell you whether we can reproduce the vulnerability.
3. We fix a confirmed vulnerability in a new version of the plugin. Merchants get it as an update through the JTL Extension Store; the changelog names the fix.
4. Every report is recorded with its outcome in our register of vulnerabilities.

Whether a plugin sold through the JTL Extension Store makes us a manufacturer under Regulation (EU) 2024/2847 (Cyber Resilience Act) is not legally settled yet. Until it is, we handle vulnerabilities as if we were a manufacturer: we report actively exploited vulnerabilities as Art. 14 of that regulation describes, through the single reporting platform to the competent CSIRT, in Germany the BSI, and inform the users.

Which versions get updates

Security updates are released for the newest version of a plugin. Please install updates as soon as they are released.

Sicherheitslücke melden (Deutsch)

Bitte melden Sie eine vermutete Sicherheitslücke in Kaufquelle oder Produktpass vertraulich an security@extensionfoundry.com, mit den Versionen des Plugins, von JTL-Shop und von PHP und den Schritten, sie nachzuvollziehen, und ohne Daten von Käufern. Sie erhalten eine Eingangsbestätigung innerhalb von zwei Werktagen. Eine bestätigte Lücke beheben wir in einer neuen Version, als Update über den JTL Extension Store und im Changelog genannt.