medium5.3
CVE-2024-31447
Shopware Improper Session Handling in store-api account logout
Impact
### Impact When a authentificated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. ### Patches The problem has been fixed with Shopware 6.6.1.0 and 6.5.8.8. ### Workarounds When you are not able to update, you can install the latest version of the Shopware Security Plugin.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | shopware/core | >= 6.3.5.0, < 6.5.8.8 | 6.5.8.8 |
| composer | shopware/platform | >= 6.3.5.0, < 6.5.8.8 | 6.5.8.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Shopware | Shopware | from 6.3.5.0 before 6.5.8.8 from 6.6.0.0 before 6.6.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/shopware/shopware/commit/5cc84ddd817ad0c1d07f9b3c79ab346d50514a77
- https://github.com/shopware/shopware/commit/d29775aa758f70d08e0c5999795c7c26d230e7d3
- https://github.com/shopware/shopware/security/advisories/GHSA-5297-wrrp-rcj7
- https://github.com/advisories/GHSA-5297-wrrp-rcj7
- https://nvd.nist.gov/vuln/detail/CVE-2024-31447