Critical severity · published Jan 17, 2023
CVE-2023-22732
Shopware is an open source commerce platform based on Symfony Framework and Vue js
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. In version 6.4.18.1 an automatic logout into the Administration session has been added. As a result the user will be logged out when they are inactive. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SH
Shopware · Shopware
before 6.4.18.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-22732
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-22732
Patch
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
Patch
https://github.com/shopware/platform/commit/cd7a89cbcd3a0428c6d1ef27b3aa15467a722ff6
Third Party Advisory
https://github.com/shopware/platform/security/advisories/GHSA-59qg-93jg-236f
More from Shopware
9.8
CVE-2024-42357
Shopware is an open commerce platform
9.8
CVE-2024-42355
Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag
9.8
CVE-2024-22406
Shopware is an open headless commerce platform
9.8
CVE-2021-37708
Shopware is an open source eCommerce platform
9.8
CVE-2016-3109
The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code