Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-24892

CVE-2022-24892:
Multiple valid tokens for password reset in Shopware

6.4

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-24892
GHSA ID
GHSA-3qrq-r688-vvh4
EPSS Score
0.51568%
CWE
CWE-640
Published
4/28/2022
Updated
1/30/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
shopware/shopwarecomposer>= 5.0.4, < 5.7.95.7.9

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from two key flaws: 1) The password reset token storage mechanism (sAdmin::sSavePasswordConfirmation) didn't invalidate existing tokens when creating new ones. 2) The password reset controller action (recoverPasswordAction) allowed repeated token generation without rate-limiting or token invalidation. Together these allowed multiple concurrent valid tokens. The functions are identified based on Shopware's architecture patterns, CWE-640 characteristics, and the patch requirement to enforce single valid tokens per account.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t Multipl* tok*ns *or p*sswor* r*s*t *oul* ** r*qu*st**. *ll tok*ns *oul* ** us** to ***n** t** p*sswor*. T*is m*k*s it possi*l* *or *n *tt**k*r to t*k* ov*r t** vi*tims ***ount i* s/** **ins ****ss to t** vi*tims *m*il ***ount *n* *in*s unu

Reasoning

T** vuln*r**ility st*ms *rom two k*y *l*ws: *) T** p*sswor* r*s*t tok*n stor*** m****nism (`s**min::sS*v*P*sswor**on*irm*tion`) *i*n't inv*li**t* *xistin* tok*ns w**n *r**tin* n*w on*s. *) T** p*sswor* r*s*t *ontroll*r **tion (`r**ov*rP*sswor***tion`