~ / search / GHSA-5297-wrrp-rcj7

GHSA-5297-wrrp-rcj7

Shopware Improper Session Handling in store-api account logout

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-31447

Packages

EcosystemPackageAffectedFixed in
Packagist shopware/core >= 6.3.5.0, < 6.5.8.8 6.5.8.8
Packagist shopware/platform >= 6.3.5.0, < 6.5.8.8 6.5.8.8
Packagist shopware/core >= 6.6.0.0-rc1, < 6.6.1.0 6.6.1.0
Packagist shopware/platform >= 6.6.0.0-rc1, < 6.6.1.0 6.6.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact When a authentificated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. ### Patches The problem has been fixed with Shopware 6.6.1.0 and 6.5.8.8. ### Workarounds When you are not able to update, you can install the latest version of the Shopware Security Plugin.

References

External links from the advisory. They lead to third-party sites.