TI-2024-18522 Aliases CVE-2024-27917 GHSA-c2f9-4jmm-v45m

Shopware's session is persistent in Cache for 404 pages

MEDIUM 40CWE-524Published 2024-03-06 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Shopware is an open commerce platform based on Symfony Framework and Vue. The Symfony Session Handler pops the Session Cookie and assigns it to the Response. Since Shopware 6.5.8.0, the 404 pages are cached to improve the performance of 404 pages. So the cached Response which contains a Session Cookie when the Browser accessing the 404 page, has no cookies yet. The Symfony Session Handler is in use, when no explicit Session configuration has been done. When Redis is in use for Sessions using the PHP Redis extension, this exploiting code is not used. Shopware version 6.5.8.7 contains a patch for this issue. As a workaround, use Redis for Sessions, as this does not trigger the exploit code.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00611 49th percentileScored 2026-11-07

Fix Fixed shopware (shopware): 6.5.8.7shopware/storefront (Packagist): 6.5.8.7+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
shopware	shopware	6.5.8.0 to before 6.5.8.7	6.5.8.7	Patch available	CNA
—	shopware/storefront (Packagist)	6.5.8.0 to before 6.5.8.7	6.5.8.7	Patch available	GHSA-c2f9-4jmm-v45m
—	shopware/platform (Packagist)	6.5.8.0 to before 6.5.8.7	6.5.8.7	Patch available	GHSA-c2f9-4jmm-v45m

shopware Vendorshopware Affected 6.5.8.0 to before 6.5.8.7 Fixed in 6.5.8.7 Patch available CNA
shopware/storefront (Packagist) Vendor— Affected 6.5.8.0 to before 6.5.8.7 Fixed in 6.5.8.7 Patch available GHSA-c2f9-4jmm-v45m
shopware/platform (Packagist) Vendor— Affected 6.5.8.0 to before 6.5.8.7 Fixed in 6.5.8.7 Patch available GHSA-c2f9-4jmm-v45m

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:shopware:shopware::::::::	6.5.8.0 to before 6.5.8.7	Vulnerable	shopware

cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:* Versions 6.5.8.0 to before 6.5.8.7 Vulnerable ·shopware

Remediation

Fix · CNA shopware (shopware) Fixed in 6.5.8.7
Fix · GHSA-c2f9-4jmm-v45m shopware/storefront (Packagist) Fixed in 6.5.8.7 Advisory →
Fix · GHSA-c2f9-4jmm-v45m shopware/platform (Packagist) Fixed in 6.5.8.7 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-27917
2026-10-03 Alias added: GHSA-c2f9-4jmm-v45m

References

Patch 2

Advisory 1

https://github.com/shopware/shopware/security/advisories/GHSA-c2f9-4jmm-v45m

Other 2

TI-2023-01895 Improper Control of Generation of Code in Twig Rendered Views in Shopware CVSS 3.1HIGH 8.8
TI-2025-20623 Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the… CVSS 3.1MEDIUM 6.8
TI-2024-28343 Shopware vulnerable to Server Side Template Injection in Twig using Context functions CVSS 3.1HIGH 8.3
TI-2019-09582 In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can… CVSS 3.1HIGH 8.8
TI-2016-02607 The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code. CVSS 3.0CRITICAL 9.8
TI-2025-32365 A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation… CVSS 3.1MEDIUM 6.1

See all 66 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences