UpHeron
All vulnerabilities

Servers and applications

CVE-2023-22732

Insufficient Session Expiration in Administration

Severity
Critical 9.8
Published
17 Jan 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
6.4.18.1
Also known as
GHSA-59qg-93jg-236f
Sources
NVD, Project advisories (GitHub)

Description

Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. In version 6.4.18.1 an automatic logout into the Administration session has been added. As a result the user will be logged out when they are inactive. Users are…

Affected software

SoftwareAffected versions
ShopwareServers and applications · cpe:a:shopware:shopware
  • Every version before 6.4.18.1
ShopwareServers and applications · github:shopware/shopware
  • Every version before 6.4.18.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-22732
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-22732
  • GitHub Advisory Database https://github.com/advisories/GHSA-59qg-93jg-236f
  • github.com https://github.com/shopware/shopware/security/advisories/GHSA-59qg-93jg-236f