CVE-2022-24747: HTTP caching is marking private HTTP headers as public
Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sensitive HTTP headers to be non-cacheable. If there is an HTTP cache between the server and client then headers may be exposed via HTTP caches. This issue has been resolved in version 6.4.8.2. There are no known workarounds.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-24747?
CVE-2022-24747 is a vulnerability in Shopware, an open commerce platform, that allows sensitive HTTP headers to be exposed via HTTP caches.
What is the severity of CVE-2022-24747?
CVE-2022-24747 has a severity rating of medium, with a severity value of 5.3.
How does CVE-2022-24747 affect Shopware?
Affected versions of Shopware, up to 6.4.8.2, do not properly set sensitive HTTP headers to be non-cacheable.
How can I fix CVE-2022-24747 in Shopware?
To fix CVE-2022-24747 in Shopware, you should apply the necessary security updates provided by the vendor (Shopware) and follow their recommended guidelines.
Where can I find more information about CVE-2022-24747?
You can find more information about CVE-2022-24747 on the official Shopware documentation and the related GitHub references provided.