CVE-2024-31447 json
Shopware has Improper Session Handling in store-api
published 2024-04-08 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-1097 , GHSA-5297-wrrp-rcj7
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. The problem has been fixed in Shopware 6.6.1.0 and 6.5.8.8. Those who are unable to update can install the latest version of the Shopware Security Plugin as a workaround.
Patch / fix
- packagist shopware/core 6.5.8.8, 6.6.1.0
- packagist shopware/platform 6.5.8.8, 6.6.1.0
- shopware shopware 6.5.8.8, 6.6.1.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.50% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | shopware/core | >=6.3.5.0, <6.5.8.8 >=6.6.0.0-rc1, <6.6.1.0 |
6.5.8.8 6.6.1.0 |
| packagist | shopware/platform | >=6.3.5.0, <6.5.8.8 >=6.6.0.0-rc1, <6.6.1.0 |
6.5.8.8 6.6.1.0 |
Affected products
- shopware shopware
Classification
- Weakness
-
- CWE-613 DEPRECATED: Insufficient Session Expiration
References
-
github.com
/shopware/shopware/commit/5cc84ddd817ad0c1d07f9b3c79ab346d50514a77
web, patch
-
github.com
/shopware/shopware/commit/d29775aa758f70d08e0c5999795c7c26d230e7d3
web, patch
-
github.com
/shopware/shopware/security/advisories/GHSA-5297-wrrp-rcj7
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-31447
advisory
-
github.com
/shopware/shopware
package
Sources
- CVE List CVE-2024-31447
- GitHub Advisory GHSA-5297-wrrp-rcj7
- NVD CVE-2024-31447
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.