UpHeron
All vulnerabilities

Servers and applications

CVE-2024-31447

Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and…

Severity
Medium 5.3
Published
8 Apr 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
6.5.8.8, 6.6.1.0
Sources
NVD

Affected software

SoftwareAffected versions
ShopwareServers and applications · cpe:a:shopware:shopware
  • From 6.3.5.0 before 6.5.8.8
  • From 6.6.0.0 before 6.6.1.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-31447
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-31447