CVE-2024-31447CWE-613

Shopware has Improper Session Handling in store-api

Medium · published April 8, 2024

CVSS v3.1
5.3
EPSS
0%
Percentile
41.8
In the wild
Unconfirmed
What it is

Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. The problem has been fixed in Shopware 6.6.1.0 and 6.5.8.8. Those who are unable to update can install the latest version of the Shopware Security Plugin as a workaround.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00499 · 41.8th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2024-04-08T15:39Z
EPSS history
Timeline
  • 08 APR 15:39Z
    Shopware has Improper Session Handling in store-api
    cvelistv5