CVE-2022-24744: falha de baixa gravidade em shopware platform
Insufficient Session Expiration in shopware
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 2.6epss 0.5%
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Produtos afetados
shopware · platformCVEs relacionadas — shopware platform
No mesmo produto, das mais perigosas para as menos.
CVE-2021-37708HIGHCommand injection in mail agent settingsEPSS 2.4%CVE-2021-32717HIGHPrivate files publicly accessible with Cloud Storage providersEPSS 1.5%CVE-2023-22731CRITICALImproper Control of Generation of Code in Twig rendered views in shopwareEPSS 1.4%CVE-2021-32711CRITICALLeak of information via Store-APIEPSS 1.4%CVE-2021-32716MEDIUMInternal hidden fields are visible on to many associations in admin apiEPSS 1.1%CVE-2022-24747MEDIUMHTTP caching is marking private HTTP headers as publicEPSS 1.1%