High severity · published Jan 5, 2022
CVE-2022-21652
Shopware is an open source e-commerce software platform
8.1
CVSS
0.8%
EPSS
No
On KEV
Description
Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. With version 5.7.7 the session validation was adjusted, so that sessions created prior to the latest password change of a customer account can't be used to login with said account. This also means, that upon a password change, all existing sessions for a given customer account are automatically considered invalid. There is no workaround for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SH
Shopware · Shopware
5.7.3 before 5.7.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-21652
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-21652
Patch
https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022
Patch
https://github.com/shopware/shopware/commit/47ebd126a94f4b019b6fde64c0df3d18d74ef7d0
Patch
https://github.com/shopware/shopware/security/advisories/GHSA-p523-jrph-qjc6
More from Shopware
9.8
CVE-2024-42357
Shopware is an open commerce platform
9.8
CVE-2024-42355
Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag
9.8
CVE-2024-22406
Shopware is an open headless commerce platform
9.8
CVE-2023-22732
Shopware is an open source commerce platform based on Symfony Framework and Vue js
9.8
CVE-2021-37708
Shopware is an open source eCommerce platform