GHSA-w267-m9c4-8555 CVE-2022-24744
Shopware user session is not logged out if the password is reset via password recovery
- Severity
- 2.6 / 10
- Low · CVSS 3.1
- Exploit chance (EPSS)
- 0.48%
- Chance of exploitation in the next 30 days. Higher than 41.77% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-613 Insufficient Session Expiration
- Fix
- Available
- 2 packages have a fixed version
Description
Impact
User session is not logged out if the password is reset via password recovery
Patches
Fixed in 6.4.8.1, maintainers recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/download/#shopware-6
Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| shopware/core | < 6.4.8.1 |
6.4.8.1 |
| shopware/platform | < 6.4.8.1 |
6.4.8.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
shopware/core Packagist → 6.4.8.1
- composer
composer require shopware/core:^6.4.8.1
shopware/platform Packagist → 6.4.8.1
- composer
composer require shopware/platform:^6.4.8.1
Severity breakdown
CVSS 3.1 2.6
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-613: Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
How to prevent it
- Implementation: Set sessions/credentials expiration date.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-gq96-5pfx-f4vc Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation | Medium | Also affects shopware/core |
| GHSA-xvhc-gm7j-mhmc Shopware: Stored XSS via SVG file upload — no SVG sanitization | Medium | Also affects shopware/core |
| GHSA-9v5m-39wh-5chq Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment | Medium | Also affects shopware/core |
| GHSA-f8q6-3g5w-jjr6 Shopware: Admin API ACL Bypass in Order State Transition Endpoints | Medium | Also affects shopware/core |
| GHSA-4x3x-869w-xx3m Shopware SSO referer trust leading to an arbitrary redirect target | Medium | Also affects shopware/core |
| GHSA-7w52-7jvm-m9vw Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames | Low | Also affects shopware/core |
| GHSA-v39m-97p8-gqg7 Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts | Medium | Also affects shopware/core |
| GHSA-8v9p-g828-v98f Shopware: Admin Account Takeover via User Recovery Hash Exposure | Medium | Also affects shopware/core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor