Homepage
About Snyk

Insufficient Session Expiration Affecting shopware/core package, versions >=6.3.5.0, <6.5.8.8 >=6.6.0.0, <6.6.1.0

0.0
medium

Snyk CVSS

    Attack Complexity High
    User Interaction Required
    Integrity High

    Threat Intelligence

    EPSS 0.05% (15th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PHP-SHOPWARECORE-6592762
  • published 9 Apr 2024
  • disclosed 8 Apr 2024
  • credit mdanilowicz
Report a new vulnerability Found a mistake?

Introduced: 8 Apr 2024

New CVE-2024-31447 Open this link in a new tab
CWE-613 Open this link in a new tab

How to fix?

Upgrade shopware/core to version 6.5.8.8, 6.6.1.0 or higher.

Overview

shopware/core is a Shopware platform is the core for all Shopware ecommerce products.

Affected versions of this package are vulnerable to Insufficient Session Expiration due to the handling of authenticated requests to POST /store-api/account/logout, where the cart is cleared but the user session remains active. This issue is specific to direct store-api usage, as the PHP Storefront component properly listens to CustomerLogoutEvent and invalidates the session.

Workaround

When not able to update, the latest version of the Shopware Security Plugin can be installed instead.