CVE-2024-31447
published 2024-04-08CVE-2024-31447: Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a…
PriorityP428medium5.3CVSS 3.1
AVNACHPRNUIRSUCNIHAN
EPSS
0.50%
39.3th percentile
Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. The problem has been fixed in Shopware 6.6.1.0 and 6.5.8.8. Those who are unable to update can install the latest version of the Shopware Security Plugin as a workaround.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| shopware | core | >= 6.3.5.0 < 6.5.8.8 | 6.5.8.8 |
| shopware | core | >= 6.6.0.0-rc1 < 6.6.1.0 | 6.6.1.0 |
| shopware | platform | >= 6.3.5.0 < 6.5.8.8 | 6.5.8.8 |
| shopware | platform | >= 6.6.0.0-rc1 < 6.6.1.0 | 6.6.1.0 |
| shopware | shopware | — | — |
| shopware | shopware | — | — |
| shopware | shopware | >= 6.3.5.0 < 6.5.8.8 | 6.5.8.8 |
| shopware | shopware | >= 6.6.0.0 < 6.6.1.0 | 6.6.1.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Shopware Improper Session Handling in store-api account logout
osv·2024-04-08
CVE-2024-31447 [MEDIUM] Shopware Improper Session Handling in store-api account logout
Shopware Improper Session Handling in store-api account logout
### Impact
When a authentificated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally.
### Patches
The problem has been fixed with Shopware 6.6.1.0 and 6.5.8.8.
### Workarounds
When you are not able to update, you can install the latest version of the Shopware Security Plugin.
GHSA
Shopware Improper Session Handling in store-api account logout
ghsa·2024-04-08
CVE-2024-31447 [MEDIUM] CWE-613 Shopware Improper Session Handling in store-api account logout
Shopware Improper Session Handling in store-api account logout
### Impact
When a authentificated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally.
### Patches
The problem has been fixed with Shopware 6.6.1.0 and 6.5.8.8.
### Workarounds
When you are not able to update, you can install the latest version of the Shopware Security Plugin.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/shopware/shopware/commit/5cc84ddd817ad0c1d07f9b3c79ab346d50514a77https://github.com/shopware/shopware/commit/d29775aa758f70d08e0c5999795c7c26d230e7d3https://github.com/shopware/shopware/security/advisories/GHSA-5297-wrrp-rcj7https://github.com/shopware/shopware/commit/5cc84ddd817ad0c1d07f9b3c79ab346d50514a77https://github.com/shopware/shopware/commit/d29775aa758f70d08e0c5999795c7c26d230e7d3https://github.com/shopware/shopware/security/advisories/GHSA-5297-wrrp-rcj7
2024-04-08
Published