Insecure Session Management

2021-03-1506:19:22

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

30.9%

JSON

shopware/platform uses an insecure session management. The application does not invalidate session tokens upon log out. This allows an attacker to gain access to the application if an old session token was obtained.

CPENameOperatorVersion
shopware/platformle6.3.5.1

CPE	Name	Operator	Version
	shopware/platform	le	6.3.5.1

References

docs.shopware.com/en/shopware-6-en/security-updates/security-update-03-2021

github.com/advisories/GHSA-h9q8-5gv2-v6mg

github.com/shopware/platform/commit/010c0154bea57c1fca73277c7431d029db7a972e

github.com/shopware/platform/security/advisories/GHSA-h9q8-5gv2-v6mg

0.001 Low

EPSS

Percentile

30.9%

JSON

Related for VERACODE:29695