CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24745 – Guest session is shared between customers in shopware
https://notcve.org/view.php?id=CVE-2022-24745
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared between customers when HTTP cache is enabled. This can lead to inconsistent experiences for guest users. Setups with Varnish are not affected by this issue. This issue has been resolved in version 6.4.8.2. • https://github.com/shopware/platform/security/advisories/GHSA-jp6h-mxhx-pgqh • CWE-384: Session Fixation •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24746 – HTML injection possibility in voucher code form
https://notcve.org/view.php?id=CVE-2022-24746
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possible to inject code via the voucher code form. This issue has been patched in version 6.4.8.1. There are no known workarounds for this issue. Shopware es una plataforma de comercio abierta basada en el framework php Symfony y el framework javascript Vue. • https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2022 https://github.com/shopware/platform/commit/651598a61073cbe59368e311817bdc6e7fb349c6 https://github.com/shopware/platform/security/advisories/GHSA-952p-fqcp-g8pc • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24747 – HTTP caching is marking private HTTP headers as public
https://notcve.org/view.php?id=CVE-2022-24747
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sensitive HTTP headers to be non-cacheable. If there is an HTTP cache between the server and client then headers may be exposed via HTTP caches. This issue has been resolved in version 6.4.8.2. There are no known workarounds. • https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-03-2022 https://github.com/shopware/platform/commit/d51863148f32306aafdbc7f9f48887c69fce206f https://github.com/shopware/platform/security/advisories/GHSA-6wrh-279j-6hvw • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24748 – Incorrect Authentication in shopware
https://notcve.org/view.php?id=CVE-2022-24748
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modify customers and to create orders without App Permission. This issue is a result of improper api route checking. Users are advised to upgrade to version 6.4.8.2. There are no known workarounds. • https://github.com/shopware/core/commit/329e4d7e028dd8081496cf8bd3acc822000b0ec0 https://github.com/shopware/platform/security/advisories/GHSA-83vp-6jqg-6cmr • CWE-287: Improper Authentication CWE-863: Incorrect Authorization •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-21652 – Insufficient Session Expiration in shopware
https://notcve.org/view.php?id=CVE-2022-21652
Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. With version 5.7.7 the session validation was adjusted, so that sessions created prior to the latest password change of a customer account can't be used to login with said account. This also means, that upon a password change, all existing sessions for a given customer account are automatically considered invalid. There is no workaround for this issue. • https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022 https://github.com/shopware/shopware/commit/47ebd126a94f4b019b6fde64c0df3d18d74ef7d0 https://github.com/shopware/shopware/security/advisories/GHSA-p523-jrph-qjc6 • CWE-613: Insufficient Session Expiration •