CVE-2022-21652

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. With version 5.7.7 the session validation was adjusted, so that sessions created prior to the latest password change of a customer account can't be used to login with said account. This also means, that upon a password change, all existing sessions for a given customer account are automatically considered invalid. There is no workaround for this issue.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
shopware	shopware	>=5.7.3, < 5.7.7

References

https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022Patch, Vendor Advisory
https://github.com/shopware/shopware/commit/47ebd126a94f4b019b6fde64c0df3d18d74ef7d0Patch, Third Party Advisory
https://github.com/shopware/shopware/security/advisories/GHSA-p523-jrph-qjc6Patch, Third Party Advisory
https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022Patch, Vendor Advisory
https://github.com/shopware/shopware/commit/47ebd126a94f4b019b6fde64c0df3d18d74ef7d0Patch, Third Party Advisory
https://github.com/shopware/shopware/security/advisories/GHSA-p523-jrph-qjc6Patch, Third Party Advisory

Timeline

Published: Jan 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-216537.5Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't over CVE-2022-216549.8Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation CVE-2022-216557.5Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal CVE-2022-216565.9Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to impl CVE-2022-216576.5Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set CVE-2022-216586.3Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Se CVE-2022-216595.3Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user CVE-2022-21669.8Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0.CVE-2022-216608.1Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify highe CVE-2022-216617.5WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitizatio CVE-2022-216625.4WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticate CVE-2022-216637.2WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with