Advisory Database
  • Advisories
  • Dependency Scanning
  1. composer
  2. ›
  3. shopware/storefront
  4. ›
  5. CVE-2024-27917

CVE-2024-27917: Shopware's session is persistent in Cache for 404 pages

March 6, 2024 (updated February 17, 2026)

The Symfony Session Handler, pop’s the Session Cookie and assign it to the Response. Since Shopware 6.5.8.0 the 404 pages, are cached, to improve the performance of 404 pages. So the cached Response, contains a Session Cookie when the Browser accessing the 404 page, has no cookies yet. The Symfony Session Handler is in use, when no explicit Session configuration has been done. When Redis is in use for Sessions using the PHP Redis extension, this exploiting code is not used.

References

  • github.com/advisories/GHSA-c2f9-4jmm-v45m
  • github.com/shopware/shopware
  • github.com/shopware/shopware/commit/7d9cb03225efca5f97e69b800d8747598dd15ce3
  • github.com/shopware/shopware/releases/tag/v6.5.8.7
  • github.com/shopware/shopware/security/advisories/GHSA-c2f9-4jmm-v45m
  • github.com/shopware/storefront/commit/3477e4a425d3c54b4bfae82d703fe3838dc21d3e
  • nvd.nist.gov/vuln/detail/CVE-2024-27917

Code Behaviors & Features

Detect and mitigate CVE-2024-27917 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 6.5.8.0 before 6.5.8.7

Fixed versions

  • 6.5.8.7

Solution

Upgrade to version 6.5.8.7 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Learn more about CVSS

Weakness

  • CWE-524: Use of Cache Containing Sensitive Information

Source file

packagist/shopware/storefront/CVE-2024-27917.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 25 Mar 2026 00:19:01 +0000.