CVE-2022-21652
CVE-2022-21652 · Insufficient Session Expiration in shopware
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. With version 5.7.7 the session validation was adjusted, so that sessions created prior to the latest password change of a customer account can't be used to login with said account. This also means, that upon a password change, all existing sessions for a given customer account are automatically considered invalid. There is no workaround for this issue.
CVSS 3.5 · Baja · EPSS 0,8% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
shopware
- Versiones
- >=5.7.3, < 5.7.7: Afectada
Sin corrección publicada
shopware/shopware Packagist
- Versiones
- v5.7.3
- v5.7.4
- v5.7.5
- v5.7.6
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 5.7.3, < 5.7.7
Actualiza a 5.7.7