CVE-2022-24892CWE-640

Multiple valid tokens for password reset in Shopware

Medium · published April 28, 2022

CVSS v3.1
6.4
EPSS
1%
Percentile
58.4
In the wild
Unconfirmed
What it is

Shopware is an open source e-commerce software platform. Starting with version 5.0.4 and before version 5.7.9, multiple tokens for password reset can be requested. All tokens can be used to change the password. This makes it possible for an attacker to take over the victim's account if they somehow gain access to the victims email account and find an unused password reset token in the emails. This issue is fixed in version 5.7.9.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00870 · 58.4th percentile
Weakness
CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2022-04-28T14:20Z
EPSS history
Timeline
  • 28 APR 14:20Z
    Multiple valid tokens for password reset in Shopware
    cvelistv5