GHSA-h9q8-5gv2-v6mg: 
PHP vulnerability analysis and mitigation

A session hijacking vulnerability was discovered in Shopware, an open source eCommerce platform, affecting versions below 6.3.5.2. The vulnerability was disclosed on March 8, 2021, and assigned CVE-2021-32710. The issue potentially allowed attackers to hijack store customer sessions (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) by NIST with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating a network-accessible vulnerability requiring no privileges or user interaction. GitHub's assessment rated it slightly lower at 5.9 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-384 (Session Fixation) (NVD).

The vulnerability could allow potential session hijacking of store customers, potentially compromising user accounts and their associated data (GitHub Advisory).

The vulnerability is remotely exploitable with no authentication required, though specific exploit details have not been publicly disclosed (NVD).

Users are recommended to update to version 6.3.5.2 which contains the security fix. The update is available through the Auto-Updater or via the download overview. For older versions (6.1 and 6.2), security measures are available via a plugin. For full functionality, updating to the latest Shopware version is recommended (GitHub Advisory).