Veracode Vulnerability DatabaseVERACODE:45797Use Of Cache Containing Sensitive Information
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
6.8 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.5%
Shopware is vulnerable to Use of Cache Containing Sensitive Information. The vulnerability is due to caching 404 pages with Session Cookies set in the cached response which is used by the Session Handler. This can allow an attacker to access the page with 404 response and steal the session cookie.
| CPE | Name | Operator | Version |
|---|---|---|---|
| shopware/storefront | le | v6.5.8.6 | |
| shopware/platform | le | v6.5.8.6 | |
| shopware/storefront | le | v6.5.8.6 | |
| shopware/platform | le | v6.5.8.6 |
References
github.com/advisories/GHSA-c2f9-4jmm-v45m
github.com/shopware/shopware/commit/7d9cb03225efca5f97e69b800d8747598dd15ce3
github.com/shopware/shopware/releases/tag/v6.5.8.7
github.com/shopware/shopware/security/advisories/GHSA-c2f9-4jmm-v45m
github.com/shopware/storefront/commit/3477e4a425d3c54b4bfae82d703fe3838dc21d3e
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
6.8 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.5%