GitHub Advisoryadvisory · Packagist

GHSA-5297-wrrp-rcj7 Shopware Improper Session Handling in store-api account logout

MEDIUM Published 2024-04-08 Modified 2024-04-08 Official page ↗
Aliases
CVE-2024-31447
Ecosystem
Packagist
Packages
shopware/core, shopware/platform
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-613
Reviewed
2024-04-08

Affected packages

• Packagist shopware/core: >= 6.3.5.0, < 6.5.8.8 → fixed in 6.5.8.8 • Packagist shopware/platform: >= 6.3.5.0, < 6.5.8.8 → fixed in 6.5.8.8 • Packagist shopware/core: >= 6.6.0.0-rc1, < 6.6.1.0 → fixed in 6.6.1.0 • Packagist shopware/platform: >= 6.6.0.0-rc1, < 6.6.1.0 → fixed in 6.6.1.0

Description

Impact When a authentificated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. Patches The problem has been fixed with Shopware 6.6.1.0 and 6.5.8.8. Workarounds When you are not able to update, you can install the latest version of the Shopware Security Plugin.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2024-31447 Shopware 6 is an open commerce platform based on Symfony Framework and Vue. vulnerability

References