Every CVE Search/ Get API key

CVE-2022-24744

Insufficient Session Expiration in shopware

2.6 LowFix available

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.48%Down 0.4 points since Mar 10, 2022
90%50%10%1%

What each source reports

CVE List Score used 2.6

Insufficient Session Expiration in shopware

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

Record
CVE-2022-24744
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Weakness
CWE-613
Updated
2026-11-02
EUVDEUVD-2022-1559 2.6

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

Record
EUVD-2022-1559
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-w267-m9c4-8555 2.6

Shopware user session is not logged out if the password is reset via password recovery

Impact

User session is not logged out if the password is reset via password recovery

Patches

Fixed in 6.4.8.1, maintainers recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

Workarounds

For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

Record
GHSA-w267-m9c4-8555
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Weakness
CWE-613
Updated
2026-11-02
NVD 2.6

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

Record
CVE-2022-24744
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS 3.1
3.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS 2.0
3.5 LowAV:N/AC:M/Au:S/C:P/I:N/A:N
Weakness
CWE-613
Updated
2026-11-02
OSV 2.6

Insufficient Session Expiration in shopware

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

Record
CVE-2022-24744
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Weakness
CWE-613
Updated
2026-11-02
OSVGHSA-w267-m9c4-8555 2.6

Shopware user session is not logged out if the password is reset via password recovery

Impact

User session is not logged out if the password is reset via password recovery

Patches

Fixed in 6.4.8.1, maintainers recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

Workarounds

For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

Record
GHSA-w267-m9c4-8555
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Weakness
CWE-613
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
shopware/platform
Packagist
 through 6.4.8.0
6.4.8.1
shopware/core
Packagist
 through 6.4.8.0
6.4.8.1
shopware/platform
Packagist
 before 6.4.8.1, plus listed versions
6.3.0.06.3.0.16.3.0.26.3.1.06.3.1.1
Show 45 moreShow less
6.3.2.06.3.2.16.3.3.06.3.3.16.3.4.06.3.4.16.3.5.06.3.5.16.3.5.26.3.5.36.3.5.46.4.0.06.4.0.0-RC16.4.1.06.4.1.16.4.1.26.4.2.06.4.2.16.4.3.06.4.3.16.4.4.06.4.4.16.4.5.06.4.5.16.4.6.06.4.6.16.4.7.06.4.8.0v6.0.0+ea2v6.1.0v6.1.0-rc1v6.1.0-rc2v6.1.0-rc3v6.1.0-rc4v6.1.1v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.2.0v6.2.0-RC1v6.2.1v6.2.2v6.2.3
6.4.8.1
shopware/core
Packagist
 before 6.4.8.1, plus listed versions
6.3.0.06.3.0.16.3.0.26.3.1.06.3.1.1
Show 45 moreShow less
6.3.2.06.3.2.16.3.3.06.3.3.16.3.4.06.3.4.16.3.5.06.3.5.16.3.5.26.3.5.36.3.5.46.4.0.06.4.0.0-RC16.4.1.06.4.1.16.4.1.26.4.2.06.4.2.16.4.3.06.4.3.16.4.4.06.4.4.16.4.5.06.4.5.16.4.6.06.4.6.16.4.7.06.4.8.0v6.0.0+ea2v6.1.0v6.1.0-rc1v6.1.0-rc2v6.1.0-rc3v6.1.0-rc4v6.1.1v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.2.0v6.2.0-RC1v6.2.1v6.2.2v6.2.3
6.4.8.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-24744 is a low vulnerability (CVSS 2.6) in Runzero Platform, published March 9, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 42nd percentile. Fixed in shopware/platform 6.4.8.1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open