Go to homepageCyberStrike

Menu

Star on GitHub · 3.2k
Sign inDownload

CVE-2024-27917

7.5 · HIGH

Shopware is an open commerce platform based on Symfony Framework and Vue.

Published Mar 6, 2024CWE-524EPSS 0.61%

Overview

CVE-2024-27917 is a high-severity vulnerability. It was published on March 6, 2024 and has a CVSS 3.1 base score of 7.5 (HIGH).

This vulnerability has a CVSS 3.1 base score of 7.5, rated HIGH. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

Technical description

Shopware is an open commerce platform based on Symfony Framework and Vue. The Symfony Session Handler pops the Session Cookie and assigns it to the Response. Since Shopware 6.5.8.0, the 404 pages are cached to improve the performance of 404 pages. So the cached Response which contains a Session Cookie when the Browser accessing the 404 page, has no cookies yet. The Symfony Session Handler is in use, when no explicit Session configuration has been done. When Redis is in use for Sessions using the PHP Redis extension, this exploiting code is not used. Shopware version 6.5.8.7 contains a patch for this issue. As a workaround, use Redis for Sessions, as this does not trigger the exploit code.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

GitHubgithub.com/shopware/shopware/commit/7d9cb03225efca5f97e69b800d8747598dd15ce3GitHubgithub.com/shopware/shopware/releases/tag/v6.5.8.7GitHubgithub.com/shopware/shopware/security/advisories/GHSA-c2f9-4jmm-v45mGitHubgithub.com/shopware/storefront/commit/3477e4a425d3c54b4bfae82d703fe3838dc21d3eGitHubgithub.com/shopware/shopware/commit/7d9cb03225efca5f97e69b800d8747598dd15ce3GitHubgithub.com/shopware/shopware/releases/tag/v6.5.8.7GitHubgithub.com/shopware/shopware/security/advisories/GHSA-c2f9-4jmm-v45mGitHubgithub.com/shopware/storefront/commit/3477e4a425d3c54b4bfae82d703fe3838dc21d3e

How CyberStrike helps

Frequently asked questions

What is CVE-2024-27917?

CVE-2024-27917 is a high-severity vulnerability. It was published on March 6, 2024 and has a CVSS 3.1 base score of 7.5 (HIGH).

How severe is CVE-2024-27917?

This vulnerability has a CVSS 3.1 base score of 7.5, rated HIGH. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

How do I fix or remediate CVE-2024-27917?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2024-27917?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2024-27917 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related HIGH CVEs from 2024

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999