Information Exposure Through Caching Affecting shopware/platform package, versions >=6.5.8.0, <6.5.8.7


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.05% (18th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-PHP-SHOPWAREPLATFORM-6411439
  • published7 Mar 2024
  • disclosed6 Mar 2024
  • creditUnknown

Introduced: 6 Mar 2024

CVE-2024-27917  (opens in a new tab)
CWE-524  (opens in a new tab)

How to fix?

Upgrade shopware/platform to version 6.5.8.7 or higher.

Overview

shopware/platform is a Shopware e-commerce core.

Affected versions of this package are vulnerable to Information Exposure Through Caching due to the caching of the Symfony Session Handler's response for 404 pages without explicit session configuration. This behavior results in the session cookie being cached and served to subsequent visitors of the 404 page, leading to potential unauthorized access or modification of user sessions.

CVSS Scores

version 3.1