CVE-2023-22732
The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.73%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. In version 6.4.18.1 an automatic logout into the Administration session has been added. As a result the user will be logged out when they are inactive. Users are advised to upgrade. There are no known workarounds for this issue.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.73% probability · 52th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-613
- Affected
- shopware/shopware
- Source
- security-advisories@github.com
References
- https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updatesPatch, Vendor Advisory
- https://github.com/shopware/platform/commit/cd7a89cbcd3a0428c6d1ef27b3aa15467a722ff6Patch, Third Party Advisory
- https://github.com/shopware/platform/security/advisories/GHSA-59qg-93jg-236fThird Party Advisory
- https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updatesPatch, Vendor Advisory
- https://github.com/shopware/platform/commit/cd7a89cbcd3a0428c6d1ef27b3aa15467a722ff6Patch, Third Party Advisory
- https://github.com/shopware/platform/security/advisories/GHSA-59qg-93jg-236fThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.