Improper access control in Shopware - CVE-2022-24745
Published: March 9, 2022 / Updated: May 19, 2026
Vulnerability identifier: #VU131889
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-24745
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to access another customer's guest session data.
The vulnerability exists due to improper access control in the guest session handling logic when HTTP cache is enabled. A remote attacker can send requests that reuse a shared guest session to access another customer's guest session data.
Only installations with HTTP cache enabled are vulnerable. Setups using Varnish are not affected.
Affected software
Shopware
How to mitigate CVE-2022-24745
Install security update from vendor's website.
Shopware - update to 6.4.8.2