CVE-2024-27917

Katalog CVE

CVSS 7.5 · High EPSS 0,61%

Kerentanan Use of Cache Containing Sensitive Information pada shopware. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Shopware is an open commerce platform based on Symfony Framework and Vue. The Symfony Session Handler pops the Session Cookie and assigns it to the Response. Since Shopware 6.5.8.0, the 404 pages are cached to improve the performance of 404 pages. So the cached Response which contains a Session Cookie when the Browser accessing the 404 page, has no cookies yet. The Symfony Session Handler is in use, when no explicit Session configuration has been done. When Redis is in use for Sessions using the PHP Redis extension, this exploiting code is not used. Shopware version 6.5.8.7 contains a patch for this issue. As a workaround, use Redis for Sessions, as this does not trigger the exploit code.

Rincian

Terbit di NVD

6 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-524: Use of Cache Containing Sensitive Information

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/shopware/shopware/security/advisories/GHSA-c2f9-4jmm-v45m mitigasi · advisory vendor
• https://github.com/shopware/shopware/commit/7d9cb03225efca5f97e69b800d8747598dd15ce3 patch
• https://github.com/shopware/storefront/commit/3477e4a425d3c54b4bfae82d703fe3838dc21d3e patch
• https://github.com/shopware/shopware/releases/tag/v6.5.8.7 release notes