CVE-2023-22732 json
Insufficient Session Expiration in Administration in shopware
published 2023-01-17 3 y ago modified 2026-09-10 1 mo ago also GHSA-59qg-93jg-236f , EUVD-2023-0338
- cvss
- 3.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. In version 6.4.18.1 an automatic logout into the Administration session has been added. As a result the user will be logged out when they are inactive. Users are advised to upgrade. There are no known workarounds for this issue.
Patch / fix
- packagist shopware/platform 6.4.18.1
- packagist shopware/core 6.4.18.1
- shopware shopware 6.4.18.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.76% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | shopware/platform | <6.4.18.1 |
6.4.18.1 |
| packagist | shopware/core | <6.4.18.1 |
6.4.18.1 |
Affected products
- shopware platform
Classification
- Weakness
-
- CWE-613 DEPRECATED: Insufficient Session Expiration
References
-
github.com
/shopware/platform/commit/cd7a89cbcd3a0428c6d1ef27b3aa15467a722ff6
web, patch, third-party-advisory
-
docs.shopware.com
/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
web, patch, vendor-advisory
-
github.com
/shopware/platform/security/advisories/GHSA-59qg-93jg-236f
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-22732
advisory
-
github.com
/shopware/platform
package
Sources
- CVE List CVE-2023-22732
- GitHub Advisory GHSA-59qg-93jg-236f
- NVD CVE-2023-22732
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.