CVE-2024-31447

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-31447
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31447.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-31447
Aliases
Published
2024-04-08T15:39:29.678Z
Modified
2026-07-08T08:05:28.648563792Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Shopware has Improper Session Handling in store-api
Details

Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to POST /store-api/account/logout, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on CustomerLogoutEvent and invalidates the session additionally. The problem has been fixed in Shopware 6.6.1.0 and 6.5.8.8. Those who are unable to update can install the latest version of the Shopware Security Plugin as a workaround.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31447.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-613"
    ]
}
References

Affected packages

Git / github.com/shopware/shopware

Affected ranges

Type
GIT
Repo
https://github.com/shopware/shopware
Events
Introduced
66159e4fb46be910e5a548305427034e837dd0c8
Fixed
3e8a794d242f9fc3a4b2d3dfb185ca20662006b8
Introduced
b0ae9ef3fae80afcc4f38401c09037fa7adc57b0
Fixed
6c01b6a2101899c53817ae5295b233d39ae8950e
Fixed
5cc84ddd817ad0c1d07f9b3c79ab346d50514a77
Fixed
d29775aa758f70d08e0c5999795c7c26d230e7d3
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "6.3.5.0"
        },
        {
            "fixed": "6.5.8.8"
        },
        {
            "introduced": "6.6.0.0"
        },
        {
            "fixed": "6.6.1.0"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31447.json"