p PatchFirst

CVE-2022-21652

CVE-2022-21652 · Insufficient Session Expiration in shopware

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. With version 5.7.7 the session validation was adjusted, so that sessions created prior to the latest password change of a customer account can't be used to login with said account. This also means, that upon a password change, all existing sessions for a given customer account are automatically considered invalid. There is no workaround for this issue.

CVSS 3.5 · Low · EPSS 0.8% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • shopware

    Versions
    • >=5.7.3, < 5.7.7: Affected

    No fix published

  • shopware/shopware Packagist

    Versions
    • v5.7.3
    • v5.7.4
    • v5.7.5
    • v5.7.6
    Affected ranges
    • ECOSYSTEM: ≥ 5.7.3, < 5.7.7

    Update to 5.7.7

Original sources

Check your server →