PT-2021-19876 · Shopware · Shopware

Phil23 · Published 2021-03-12 · Updated 2021-09-08 · CVE-2021-32710

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.3.5.2

Description The issue concerns potential session hijacking of store customers.

Recommendations For versions prior to 6.3.5.2, update to the current version 6.3.5.2 via the Auto-Updater or directly via the download overview. For older versions of 6.1 and 6.2, install the corresponding security plugin to apply security measures.

Fix

Session Fixation

Insufficient Session Expiration

Weakness Enumeration

CWE-384

CWE-613

Related Identifiers

CVE-2021-32710

GHSA-C7VG-W8Q8-C3WF

GHSA-H9Q8-5GV2-V6MG

Affected Products

Shopware

References · 8

• https://github.com/shopware/platform/commit/010c0154bea57c1fca73277c7431d029db7a972e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-32710 · Security Note
• https://osv.dev/vulnerability/GHSA-h9q8-5gv2-v6mg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32710 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c7vg-w8q8-c3wf · Vendor Advisory
• https://github.com/shopware/shopware · Note
• https://github.com/shopware/platform/security/advisories/GHSA-h9q8-5gv2-v6mg · Note
• https://packagist.org/packages/shopware/platform · Note