CVE-2022-21652: Insufficient Session Expiration

January 5, 2022 (updated January 12, 2022)

Shopware is an open source e-commerce software platform.With the session validation was adjusted, so that sessions created prior to the latest password change of a customer account can’t be used to login with said account. This also means, that upon a password change, all existing sessions for a given customer account are automatically considered invalid. There is no workaround for this issue.

References

docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022
github.com/shopware/shopware/commit/47ebd126a94f4b019b6fde64c0df3d18d74ef7d0
github.com/shopware/shopware/security/advisories/GHSA-p523-jrph-qjc6
nvd.nist.gov/vuln/detail/CVE-2022-21652

Code Behaviors & Features

Detect and mitigate CVE-2022-21652 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →