CVE-2022-24744

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published: Mar 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-247456.5Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessio CVE-2022-247466.1Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possib CVE-2022-247475.3Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do CVE-2022-247487.5Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it i CVE-2022-247496.1Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containi CVE-2022-24758.8Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service. Any use CVE-2022-247507.8UltraVNC is a free and open source remote pc access software. A vulnerability has been found in versions prior to 1.3.8.0 in which the DSM p CVE-2022-247517.4Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition CVE-2022-247529.8SyliusGridBundle is a package of generic data grids for Symfony applications. Prior to versions 1.10.1 and 1.11-rc2, values added at the end CVE-2022-247537.0Stripe CLI is a command-line tool for the Stripe eCommerce platform. A vulnerability in Stripe CLI exists on Windows when certain commands a CVE-2022-247549.8PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there CVE-2022-247559.8Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 >= 18.2 but p