GitHub Advisoryadvisory · Packagist

GHSA-w267-m9c4-8555 Shopware user session is not logged out if the password is reset via password recovery

LOW Published 2022-03-10 Modified 2022-03-18 Official page ↗
Aliases
CVE-2022-24744
Ecosystem
Packagist
Packages
shopware/platform, shopware/core
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-613
Reviewed
2022-03-10

Affected packages

• Packagist shopware/platform: < 6.4.8.1 → fixed in 6.4.8.1 • Packagist shopware/core: < 6.4.8.1 → fixed in 6.4.8.1

Description

Impact User session is not logged out if the password is reset via password recovery Patches Fixed in 6.4.8.1, maintainers recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 Workarounds For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2022-24744 Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. vulnerability

References