GitHub Advisoryadvisory · Packagist

GHSA-jp6h-mxhx-pgqh Shopware guest session is shared between customers

MEDIUM Published 2022-03-10 Modified 2022-03-24 Official page ↗
Aliases
CVE-2022-24745
Ecosystem
Packagist
Packages
shopware/platform, shopware/storefront
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-384
Reviewed
2022-03-10

Affected packages

• Packagist shopware/platform: < 6.4.8.2 → fixed in 6.4.8.2 • Packagist shopware/storefront: < 6.4.8.2 → fixed in 6.4.8.2

Description

Impact Guest sessions are shared between customers when HTTP cache is enabled. Setups with Varnish are not affected by this issue Patches We recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 Workarounds Security Plugin For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. Disable HTTP Cache Disabling HTTP Cache is also a valid workaround

Related

Alias · CVE (1)

  • CVE-2022-24745 Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. vulnerability

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References