CVE-2022-24745CWE-384

Guest session is shared between customers in shopware

Medium · published March 9, 2022

CVSS v3.1
4.8
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared between customers when HTTP cache is enabled. This can lead to inconsistent experiences for guest users. Setups with Varnish are not affected by this issue. This issue has been resolved in version 6.4.8.2. Users unable to upgrade should disable the HTTP Cache.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00530 · 44.0th percentile
Weakness
CWE-384 · Session Fixation
Published
2022-03-09T22:25Z
EPSS history
Timeline
  • 09 MAR 22:25Z
    Guest session is shared between customers in shopware
    cvelistv5