GitHub Advisoryadvisory · Packagist

GHSA-59qg-93jg-236f Shopware has Insufficient Session Expiration in Administration

LOW Published 2023-01-20 Modified 2023-01-20 Official page ↗
Aliases
CVE-2023-22732
Ecosystem
Packagist
Packages
shopware/platform, shopware/core
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-613
Reviewed
2023-01-20

Affected packages

• Packagist shopware/platform: < 6.4.18.1 → fixed in 6.4.18.1 • Packagist shopware/core: < 6.4.18.1 → fixed in 6.4.18.1

Description

Impact The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. Patches We added an automatic logout into the Administration, so the user will be logged out when they are inactive. References https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2023-22732 Shopware is an open source commerce platform based on Symfony Framework and Vue js. vulnerability

References