CVE-2024-31447
CVSS 3.1 Score 5.3 of 10 (medium)
Details
Summary
CVE-2024-31447 affects Shopware 6 versions prior to 6.6.1.0 and 6.5.8.8, which use the Symfony Framework and Vue. In these versions, an authenticated user can make a POST request to `/store-api/account/logout`, causing the cart to be cleared but failing to log the user out. This vulnerability only impacts direct store-api usage, as Shopware also listens for the `CustomerLogoutEvent` and invalidates the session accordingly. The issue has been resolved in Shopware 6.6.1.0 and 6.5.8.8. Users unable to update can install the latest version of the Shopware Security Plugin as a temporary workaround.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.