CVE-2024-31447

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-31447
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31447.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-31447
Aliases
Published
2024-04-08T15:39:29.678Z
Modified
2026-03-14T12:30:39.553344Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Shopware has Improper Session Handling in store-api
Details

Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to POST /store-api/account/logout, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on CustomerLogoutEvent and invalidates the session additionally. The problem has been fixed in Shopware 6.6.1.0 and 6.5.8.8. Those who are unable to update can install the latest version of the Shopware Security Plugin as a workaround.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31447.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-613"
    ]
}
References

Affected packages

Git / github.com/shopware/shopware

Affected ranges

Type
GIT
Repo
https://github.com/shopware/shopware
Events
Introduced
66159e4fb46be910e5a548305427034e837dd0c8
Fixed
3e8a794d242f9fc3a4b2d3dfb185ca20662006b8
Database specific 
{
    "versions": [
        {
            "introduced": "6.3.5.0"
        },
        {
            "fixed": "6.5.8.8"
        }
    ]
}
Type
GIT
Repo
https://github.com/shopware/shopware
Events
Introduced
284adda0f68cdb90012387de894958af371bdd26
Fixed
6c01b6a2101899c53817ae5295b233d39ae8950e
Database specific 
{
    "versions": [
        {
            "introduced": "6.6.0.0-rc1"
        },
        {
            "fixed": "6.6.1.0"
        }
    ]
}

Affected versions

v6.*
v6.3.5.0
v6.4.1.0
v6.4.1.1
v6.4.1.2
v6.4.10.0
v6.4.10.1
v6.4.11.0
v6.4.11.1
v6.4.13.0
v6.4.14.0
v6.4.15.0
v6.4.15.1
v6.4.15.2
v6.4.16.0
v6.4.16.1
v6.4.17.0
v6.4.17.1
v6.4.17.2
v6.4.3.0
v6.4.3.1
v6.4.4.0
v6.4.4.1
v6.4.5.0
v6.4.5.1
v6.4.6.0
v6.4.6.1
v6.4.8.0
v6.4.8.1
v6.4.8.2
v6.4.9.0
v6.5.0.0
v6.5.0.0-rc1
v6.5.0.0-rc2
v6.5.0.0-rc3
v6.5.0.0-rc4
v6.5.1.0
v6.5.1.1
v6.5.2.0
v6.5.3.0
v6.5.3.1
v6.5.3.2
v6.5.3.3
v6.5.4.0
v6.5.5.0
v6.5.5.1
v6.5.5.2
v6.5.7.0
v6.5.7.1
v6.5.7.2
v6.5.7.3
v6.5.7.4
v6.5.8.3
v6.5.8.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31447.json"