Information Exposure Through Caching Affecting shopware/platform package, versions >=6.5.8.0, <6.5.8.7
Snyk CVSS
Attack Complexity
Low
Confidentiality
High
Threat Intelligence
EPSS
0.05% (15th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-SHOPWAREPLATFORM-6411439
- published 7 Mar 2024
- disclosed 6 Mar 2024
- credit Unknown
Introduced: 6 Mar 2024
CVE-2024-27917 Open this link in a new tabHow to fix?
Upgrade shopware/platform to version 6.5.8.7 or higher.
Overview
shopware/platform is a Shopware e-commerce core.
Affected versions of this package are vulnerable to Information Exposure Through Caching due to the caching of the Symfony Session Handler's response for 404 pages without explicit session configuration. This behavior results in the session cookie being cached and served to subsequent visitors of the 404 page, leading to potential unauthorized access or modification of user sessions.