CVE-2021-32710 - Vulnerability Details - OpenCVE

Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Shopware	Shopware

Configuration 1 [-]

cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/shopware/platform/commit/010c0154bea57c1fca73277c7431d029db7a972e
https://github.com/shopware/platform/security/advisories/GHSA-h9q8-5gv2-v6mg

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2021-06-24T19:45:17

Updated: 2024-08-03T23:25:31.138Z

Reserved: 2021-05-12T00:00:00

Link: CVE-2021-32710

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-06-24T20:15:09.030

Modified: 2024-11-21T06:07:34.690

Link: CVE-2021-32710

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "platform", "vendor": "shopware", "versions": [{"status": "affected", "version": "< 6.3.5.2"}]}], "descriptions": [{"lang": "en", "value": "Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-384", "description": "CWE-384: Session Fixation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-06-24T19:45:17", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/shopware/platform/security/advisories/GHSA-h9q8-5gv2-v6mg"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/shopware/platform/commit/010c0154bea57c1fca73277c7431d029db7a972e"}], "source": {"advisory": "GHSA-h9q8-5gv2-v6mg", "discovery": "UNKNOWN"}, "title": "Potential Session Hijacking in Shopware", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-32710", "STATE": "PUBLIC", "TITLE": "Potential Session Hijacking in Shopware"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "platform", "version": {"version_data": [{"version_value": "< 6.3.5.2"}]}}]}, "vendor_name": "shopware"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-384: Session Fixation"}]}]}, "references": {"reference_data": [{"name": "https://github.com/shopware/platform/security/advisories/GHSA-h9q8-5gv2-v6mg", "refsource": "CONFIRM", "url": "https://github.com/shopware/platform/security/advisories/GHSA-h9q8-5gv2-v6mg"}, {"name": "https://github.com/shopware/platform/commit/010c0154bea57c1fca73277c7431d029db7a972e", "refsource": "MISC", "url": "https://github.com/shopware/platform/commit/010c0154bea57c1fca73277c7431d029db7a972e"}]}, "source": {"advisory": "GHSA-h9q8-5gv2-v6mg", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T23:25:31.138Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/shopware/platform/security/advisories/GHSA-h9q8-5gv2-v6mg"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/shopware/platform/commit/010c0154bea57c1fca73277c7431d029db7a972e"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-32710", "datePublished": "2021-06-24T19:45:17", "dateReserved": "2021-05-12T00:00:00", "dateUpdated": "2024-08-03T23:25:31.138Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7A0743A2-E919-4F0C-A24F-F3FB8C3D16A8", "versionEndExcluding": "6.3.5.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version."}, {"lang": "es", "value": "Shopware es una plataforma de comercio electr\u00f3nico de c\u00f3digo abierto. Un potencial secuestro de la sesi\u00f3n de los clientes de la tienda en versiones inferiores a 6.3.5.2. Recomendamos actualizar a versi\u00f3n actual 6.3.5.2. Puede obtener la actualizaci\u00f3n a 6.3.5.2 regularmente por medio del Auto-Updater o directamente por medio del resumen de descargas. Para las versiones anteriores de 6.1 y 6.2, tambi\u00e9n est\u00e1n disponibles las medidas de seguridad correspondientes por medio de un plugin. Para disfrutar de todas las funciones, recomendamos actualizar a la \u00faltima versi\u00f3n de Shopware"}], "id": "CVE-2021-32710", "lastModified": "2024-11-21T06:07:34.690", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-06-24T20:15:09.030", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/shopware/platform/commit/010c0154bea57c1fca73277c7431d029db7a972e"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/shopware/platform/security/advisories/GHSA-h9q8-5gv2-v6mg"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/shopware/platform/commit/010c0154bea57c1fca73277c7431d029db7a972e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/shopware/platform/security/advisories/GHSA-h9q8-5gv2-v6mg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-384"}], "source": "security-advisories@github.com", "type": "Secondary"}]}