Shopware has Insufficient Session Expiration in Administration
### Impact The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. ### Patches We added an automatic logout into the Administration, so the user will be logged out when they are inactive. ### References https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-22732US | critical9.8 | — | ||
Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker has stolen the sessi… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updatesWEB
- https://github.com/shopware/platformPACKAGE
- https://github.com/shopware/platform/commit/cd7a89cbcd3a0428c6d1ef27b3aa15467a722ff6WEB
- https://github.com/shopware/platform/security/advisories/GHSA-59qg-93jg-236fWEB
- https://nvd.nist.gov/vuln/detail/CVE-2023-22732ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan