Shopware Improper Session Handling in store-api account logout
### Impact When a authentificated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. ### Patches The problem has been fixed with Shopware 6.6.1.0 and 6.5.8.8. ### Workarounds When you are not able to update, you can install the latest version of the Shopware Security Plugin.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-31447US | — | — | ||
Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is m… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/shopware/shopwarePACKAGE
- https://github.com/shopware/shopware/commit/5cc84ddd817ad0c1d07f9b3c79ab346d50514a77WEB
- https://github.com/shopware/shopware/commit/d29775aa758f70d08e0c5999795c7c26d230e7d3WEB
- https://github.com/shopware/shopware/security/advisories/GHSA-5297-wrrp-rcj7WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-31447ADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan