p PatchFirst

CVE-2022-21652

CVE-2022-21652 · Insufficient Session Expiration in shopware

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. With version 5.7.7 the session validation was adjusted, so that sessions created prior to the latest password change of a customer account can't be used to login with said account. This also means, that upon a password change, all existing sessions for a given customer account are automatically considered invalid. There is no workaround for this issue.

CVSS 3.5 · Faible · EPSS 0,8% · Correctif disponible

Publication
Mise à jour

Pile logicielle: php

Produits et versions concernés

  • shopware

    Versions du logiciel
    • >=5.7.3, < 5.7.7: Concernée

    Aucun correctif publié

  • shopware/shopware Packagist

    Versions du logiciel
    • v5.7.3
    • v5.7.4
    • v5.7.5
    • v5.7.6
    Plages de versions concernées
    • ECOSYSTEM: ≥ 5.7.3, < 5.7.7

    Mettez à jour vers 5.7.7

Sources originales

Vérifiez votre serveur →