CVE-2021-32710

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-384

Affected software

Vendor	Product	Versions
shopware	platform	< 6.3.5.2

References

https://github.com/shopware/platform/commit/010c0154bea57c1fca73277c7431d029db7a972ePatch, Third Party Advisory
https://github.com/shopware/platform/security/advisories/GHSA-h9q8-5gv2-v6mgThird Party Advisory
https://github.com/shopware/platform/commit/010c0154bea57c1fca73277c7431d029db7a972ePatch, Third Party Advisory
https://github.com/shopware/platform/security/advisories/GHSA-h9q8-5gv2-v6mgThird Party Advisory

Timeline

Published: Jun 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-327117.5Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only CVE-2021-327125.3Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. User CVE-2021-327134.8Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerabil CVE-2021-327149.1hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an intege CVE-2021-327155.3hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length CVE-2021-327164.9Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an as CVE-2021-327177.5Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers w CVE-2021-327185.4RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could le CVE-2021-327194.8RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the Rabbi CVE-2021-32725.5jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between th CVE-2021-327205.3Sylius is an Open Source eCommerce platform on top of Symfony. In versions of Sylius prior to 1.9.5 and 1.10.0-RC.1, part of the details (or CVE-2021-327216.1PowerMux is a drop-in replacement for Go's http.ServeMux. In PowerMux versions prior to 1.1.1, attackers may be able to craft phishing links