Lucene search

[email protected]CVE-2023-22732

HistoryJan 17, 2023 - 10:15 p.m.

CVE-2023-22732

2023-01-1722:15:11

CWE-613

[email protected]

web.nvd.nist.gov

shopware

commerce

platform

symfony framework

vue js

cve-2023-22732

nvd

security issue

administration session

session cookie

automatic logout

upgrade required

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.8%

JSON

Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. In version 6.4.18.1 an automatic logout into the Administration session has been added. As a result the user will be logged out when they are inactive. Users are advised to upgrade. There are no known workarounds for this issue.

Affected configurations

Vulners

NVD

Node

shopwareshopwareRange<6.4.18.1

VendorProductVersionCPE
shopwareshopware*cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
shopware	shopware	*	cpe:2.3:a:shopware:shopware::::::::

CNA Affected

[
  {
    "vendor": "shopware",
    "product": "platform",
    "versions": [
      {
        "version": "< 6.4.18.1",
        "status": "affected"
      }
    ]
  }
]