Shopware has Insufficient Session Expiration in Administration
### Impact The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. ### Patches We added an automatic logout into the Administration, so the user will be logged out when they are inactive. ### References https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-22732US | critical9.8 | — | ||
Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker has stolen the sessi… | ||||
02
references
External citations — patches, advisories, analysis.
- https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updatesWEB
- https://github.com/shopware/platformPACKAGE
- https://github.com/shopware/platform/commit/cd7a89cbcd3a0428c6d1ef27b3aa15467a722ff6WEB
- https://github.com/shopware/platform/security/advisories/GHSA-59qg-93jg-236fWEB
- https://nvd.nist.gov/vuln/detail/CVE-2023-22732ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan