Insufficient Session Expiration in shopware

HIGH 8.1CVE-2022-21652 · GHSA-p523-jrph-qjc6 · Published 05/01/2022 · updated 17/06/2026

In short

CVE-2022-21652 is a HIGH (CVSS 8.1) vulnerability affecting shopware/shopware, shopware (shopware).
Chance of exploitation in the next 30 days (EPSS): 0.82%, higher than 57.2% of all vulnerabilities.
Fix: update to 5.7.7 or later.

Package	Affected versions	Patched versions
shopware/shopware Packagist	`≥ 5.7.3, < 5.7.7`	`5.7.7`
shopware shopware	`≥ 5.7.3, < 5.7.7`	`5.7.7`

Description

Impact

Automatically invalidate sessions upon password change

Patches

We recommend updating to the current version 5.7.7. You can get the update to 5.7.7 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

References

https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022

NVD description

Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. With version 5.7.7 the session validation was adjusted, so that sessions created prior to the latest password change of a customer account can't be used to login with said account. This also means, that upon a password change, all existing sessions for a given customer account are automatically considered invalid. There is no workaround for this issue.

References

shopware/shopware security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-21652 · ADVISORY
shopware/shopware commit 47ebd12 · WEB
docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022 · WEB
shopware/shopware · PACKAGE

More vulnerabilities in shopware/shopware

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

shopware/shopware

Packagist

≥ 5.7.3, < 5.7.7

5.7.7

shopware

≥ 5.7.3, < 5.7.7

5.7.7

Description

Impact

Automatically invalidate sessions upon password change

Patches

We recommend updating to the current version 5.7.7. You can get the update to 5.7.7 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

References

https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022

NVD description

More vulnerabilities in shopware/shopware

See all →