CVE-2023-22732

CVE-2023-22732 addresses a critical session management vulnerability in Shopware, an open-source e-commerce platform. The flaw allowed attackers who stole a session cookie to maintain unauthorized access to the Administration panel for up to one week due to an extended session expiration. This vulnerability carries a CVSS score of 9.8 (Critical), indicating a high potential for complete compromise of confidentiality, integrity, and availability, with an easily exploitable network-based attack vector requiring no user interaction. While no active exploitation, public exploit code, or significant community discussion has been observed, the high severity necessitates immediate patching to version 6.4.18.1, which introduces automatic logout for inactive Administration sessions.