CVE-2021-32710: 
PHP vulnerability analysis and mitigation

Shopware, an open source eCommerce platform, was affected by a potential session hijacking vulnerability in versions below 6.3.5.2. The vulnerability was discovered and disclosed on June 24, 2021, identified as CVE-2021-32710. The issue affected store customers using the platform (NVD, GitHub Advisory).

The vulnerability was related to session handling during user logouts. The issue involved incorrect implementation of the 'invalidateSessionOnLogOut' setting in loginRegistration.xml, which controls session behavior during logout operations. The CVSS v3.1 base score was rated as 7.5 HIGH by NVD with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating a high severity issue with network accessibility and no required privileges or user interaction (NVD).

The vulnerability could allow attackers to potentially hijack store customer sessions, which could lead to unauthorized access to user accounts and compromise of user data (GitHub Advisory).

The vulnerability was network accessible (AV:N) with low attack complexity (AC:L) and required no privileges (PR:N) or user interaction (UI:N). This made the vulnerability relatively straightforward to exploit if discovered (NVD).

The vulnerability was patched in version 6.3.5.2. Users were recommended to update to this version either through the Auto-Updater or via the download overview. For older versions 6.1 and 6.2, security measures were made available through a plugin. For full functionality, updating to the latest Shopware version was recommended (GitHub Advisory).