Medium severity · published Apr 8, 2024
CVE-2024-31447
Shopware 6 is an open commerce platform based on Symfony Framework and Vue
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. The problem has been fixed in Shopware 6.6.1.0 and 6.5.8.8. Those who are unable to update can install the latest version of the Shopware Security Plugin as a workaround.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SH
Shopware · Shopware
6.3.5.0 before 6.5.8.8; 6.6.0.0 before 6.6.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-31447
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-31447
Patch
https://github.com/shopware/shopware/commit/5cc84ddd817ad0c1d07f9b3c79ab346d50514a77
Patch
https://github.com/shopware/shopware/commit/d29775aa758f70d08e0c5999795c7c26d230e7d3
Vendor Advisory
https://github.com/shopware/shopware/security/advisories/GHSA-5297-wrrp-rcj7
More from Shopware
9.8
CVE-2024-42357
Shopware is an open commerce platform
9.8
CVE-2024-42355
Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag
9.8
CVE-2024-22406
Shopware is an open headless commerce platform
9.8
CVE-2023-22732
Shopware is an open source commerce platform based on Symfony Framework and Vue js
9.8
CVE-2021-37708
Shopware is an open source eCommerce platform