Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2024-31447: Shopware 6 Fails to Log Out Users from Store API
CVE-2024-31447 · published 2 years ago
Summary
An issue in Shopware 6 allows authenticated users to remain logged in after logging out through the Store API. This only affects direct API usage and does not impact the storefront. If you can't update, install the latest Security Plugin as a temporary fix.
What to do
- Update shopware core to version 6.5.8.8.
- Update shopware platform to version 6.5.8.8.
- Update shopware core to version 6.6.1.0.
- Update shopware platform to version 6.6.1.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | shopware | core |
>= 6.3.5.0, < 6.5.8.8 >= 6.6.0.0-rc1, < 6.6.1.0 Fix: upgrade to 6.5.8.8
|
| composer | shopware | platform |
>= 6.3.5.0, < 6.5.8.8 >= 6.6.0.0-rc1, < 6.6.1.0 Fix: upgrade to 6.5.8.8
|
| – | shopware | shopware |
>= 6.3.5.0, < 6.5.8.8 >= 6.6.0.0, < 6.6.1.0 cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:* |
Original advisory text
Shopware has Improper Session Handling in store-api
Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. The problem has been fixed in Shopware 6.6.1.0 and 6.5.8.8. Those who are unable to update can install the latest version of the Shopware Security Plugin as a workaround.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-31447 Vendor Advisory
- https://github.com/advisories/GHSA-5297-wrrp-rcj7
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31447... Vendor Advisory
- https://github.com/shopware/shopware/security/advisories/GHSA-5297-wrrp-rcj7 Vendor Advisory
- https://github.com/shopware/shopware/commit/5cc84ddd817ad0c1d07f9b3c79ab346d5051... Patch
- https://github.com/shopware/shopware/commit/d29775aa758f70d08e0c5999795c7c26d230... Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-613Insufficient Session Expiration
Timeline
Published8 Apr 2024
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta