PT-2022-16848 · Shopware · Shopware

Shyim · Published 2022-03-09 · Updated 2022-03-18 · CVE-2022-24745

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.4.8.2

Description The issue affects guest sessions when HTTP cache is enabled, leading to inconsistent experiences for guest users. Setups with Varnish are not affected by this issue.

Recommendations For versions prior to 6.4.8.2, update to version 6.4.8.2 to resolve the issue. For older versions of 6.1, 6.2, and 6.3, consider installing a security plugin as a workaround. As a temporary workaround, consider disabling the HTTP Cache until a patch is available.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2022-24745

GHSA-JP6H-MXHX-PGQH

Affected Products

Shopware

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24745.json · Exploit
• https://github.com/shopware/platform/security/advisories/GHSA-jp6h-mxhx-pgqh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24745 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24745 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jp6h-mxhx-pgqh · Vendor Advisory
• https://github.com/shopware/platform · Note
• https://t.me/cvenotify/28000 · Telegram Post
• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-03-2022?_ga=2.159980029.1931762803.1646933116-1088482757.1646933116 · Note