CVE-2022-24744

LOW

2.6

Beschreibung

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

CVE Details

CVSS v3.1 Bewertung2.6

SchweregradLOW

CVSS VektorCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

AngriffsvektorNETWORK

KomplexitatHIGH

Erforderliche PrivilegienLOW

BenutzerinteraktionREQUIRED

Veroffentlicht3/9/2022

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

shopware:shopware

Schwachen (CWE)

CWE-613

Referenzen

https://github.com/shopware/platform/security/advisories/GHSA-w267-m9c4-8555(security-advisories@github.com)

https://github.com/shopware/platform/security/advisories/GHSA-w267-m9c4-8555(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.