CVE-2024-31447
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-31447
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31447.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-31447
- Aliases
- Related
- Published
- 2024-04-08T16:15:08Z
- Modified
- 2025-01-15T05:13:28.280390Z
- Summary
- [none]
- Details
-
Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to
POST /store-api/account/logout, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally onCustomerLogoutEventand invalidates the session additionally. The problem has been fixed in Shopware 6.6.1.0 and 6.5.8.8. Those who are unable to update can install the latest version of the Shopware Security Plugin as a workaround. - References
Affected packages
Git / github.com/shopware/shopware
Affected ranges
- Type
- GIT
- Repo
- https://github.com/shopware/shopware
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixedFixed
Affected versions
6.*
6.5.3.1
v6.*
v6.0.0+dp1
v6.0.0+ea1
v6.0.0+ea1.1
v6.0.0+ea2
v6.1.0
v6.1.0-rc1
v6.1.0-rc2
v6.1.0-rc3
v6.1.0-rc4
v6.1.1
v6.1.2
v6.1.3
v6.1.4
v6.1.5
v6.2.0
v6.2.0-RC1
v6.2.1
v6.2.2
v6.2.3
v6.3.0.0
v6.3.0.1
v6.3.0.2
v6.3.3.0
v6.3.3.1
v6.3.4.1
v6.3.5.0
v6.4.1.0
v6.4.1.1
v6.4.1.2
v6.4.10.0
v6.4.10.1
v6.4.11.0
v6.4.11.1
v6.4.13.0
v6.4.14.0
v6.4.15.0
v6.4.15.1
v6.4.15.2
v6.4.16.0
v6.4.16.1
v6.4.17.0
v6.4.17.1
v6.4.17.2
v6.4.3.0
v6.4.3.1
v6.4.4.0
v6.4.4.1
v6.4.5.0
v6.4.5.1
v6.4.6.0
v6.4.6.1
v6.4.8.0
v6.4.8.1
v6.4.8.2
v6.4.9.0
v6.5.0.0
v6.5.0.0-rc1
v6.5.0.0-rc2
v6.5.0.0-rc3
v6.5.0.0-rc4
v6.5.1.0
v6.5.1.1
v6.5.2.0
v6.5.3.0
v6.5.3.1
v6.5.3.2
v6.5.3.3
v6.5.4.0
v6.5.5.0
v6.5.5.1
v6.5.5.2
v6.5.7.0
v6.5.7.1
v6.5.7.2
v6.5.7.3
v6.5.7.4
v6.5.8.3
v6.5.8.5