PT-2022-16847 · Shopware · Shopware

Shyim · Published 2022-03-09 · Updated 2022-03-17 · CVE-2022-24744

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.4.8.1

Description The issue concerns user sessions not being logged out when a password is reset via password recovery. This problem has been identified in Shopware, an open commerce platform based on the Symfony php Framework and the Vue javascript framework. For older versions of 6.1, 6.2, and 6.3, security measures are available via a plugin.

Recommendations For versions 6.1, 6.2, and 6.3, install the corresponding security plugin to mitigate the issue. Update to version 6.4.8.1 or later to resolve the issue. As a temporary workaround, consider manually logging out user sessions after a password reset until a patch is applied.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2022-24744

GHSA-W267-M9C4-8555

Affected Products

Shopware

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24744.json · Exploit
• https://github.com/shopware/platform/security/advisories/GHSA-w267-m9c4-8555 · Patch
• https://osv.dev/vulnerability/GHSA-w267-m9c4-8555 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24744 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24744 · Vendor Advisory
• https://github.com/shopware/platform · Note
• https://github.com/shopware/platform/commit/47b4b094c13f62db860be2f431138bb45c0bd0b6 · Note
• https://github.com/shopware/core/commit/324cd1b57db58481df1b1d0030ffc307e2d9fe64 · Note
• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2022?category=security-updates · Note
• https://t.me/cvenotify/28003 · Telegram Post