Insufficient Session Expiration in Administration in shopware

CVE-2023-22732

What is CVE-2023-22732?

Shopware, an open-source commerce platform, has a vulnerability in its administration session management where the session expiration was initially set to one week. This design flaw allows an attacker who has stolen the session cookie to maintain access for an extended period. To mitigate this risk, version 6.4.18.1 introduces automatic logout functionality that invalidates the session upon user inactivity. Users are strongly urged to upgrade to this version as there are no available workarounds for this issue.

References