CVE-2022-24747 Details
Description
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sensitive HTTP headers to be non-cacheable. If there is an HTTP cache between the server and client then headers may be exposed via HTTP caches. This issue has been resolved in version 6.4.8.2. There are no known workarounds.
A vulnerability exists in Shopware versions through 6.1.0 that improperly handles sensitive HTTP headers, allowing them to be cached and potentially exposed to clients. This issue can lead to private headers being marked as public in HTTP caches, creating a risk of sensitive information disclosure. The vulnerability has been addressed in version 6.4.8.2.
Users are advised to update to Shopware version 6.4.8.2. This update can be obtained through the Auto-Updater or directly from the Shopware download overview. For those using versions 6.1, 6.2, and 6.3, a corresponding security plugin is available, although updating to the latest version is recommended.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 23, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-03-2022 | CVE | PatchVendor Advisory |
| https://github.com/shopware/platform/commit/d51863148f32306aafdbc7f9f48887c69fce206f | CVE | PatchThird Party Advisory |
| https://github.com/shopware/platform/security/advisories/GHSA-6wrh-279j-6hvw | CVE | PatchThird Party Advisory |
| https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-03-2022 | [email protected] | PatchVendor Advisory |
| https://github.com/shopware/platform/commit/d51863148f32306aafdbc7f9f48887c69fce206f | [email protected] | PatchThird Party Advisory |
| https://github.com/shopware/platform/security/advisories/GHSA-6wrh-279j-6hvw | [email protected] | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-668 | Exposure of Resource to Wrong Sphere | [email protected] |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| shopware shopware | < 6.4.8.2 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Jun 30, 2023 | Reanalysis | [email protected] |
| Mar 17, 2022 | Initial Analysis | [email protected] |