CVE-2023-22732 LOW

CVE-2023-22732: Insufficient Session Expiration in Administration in shopware

Vendor Shopware
Product platform
Weakness CWE-613 · Insufficient session expiration
Published January 17, 2023
Last update March 10, 2025
View on NVD All CVEs

CVSS base score

3.7/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. In version 6.4.18.1 an automatic logout into the Administration session has been added. As a result the user will be logged out when they are inactive. Users are advised to upgrade. There are no known workarounds for this issue.

Key dates

02Disclosure timeline

January 17, 2023 CVE published
March 10, 2025 Record updated