Shopware Addresses Security Vulnerability in 404 Pages

CVE-2024-27917

What is CVE-2024-27917?

A vulnerability exists within the Shopware commerce platform, which utilizes the Symfony Framework and Vue. The issue arises from the handling of session cookies in cached 404 responses. When a user accesses a 404 page, a session cookie, which should not be present, can inadvertently be cached, posing a potential security risk. The vulnerability affects various versions starting from 6.5.8.0, with a patch provided in version 6.5.8.7. The use of Redis for session management is suggested as a workaround, as it circumvents the exploit by not utilizing the vulnerable Symfony Session Handler. For further information and remediation steps, refer to the official advisories and commits.

References