Mirumee

Saleor

4 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2020-15085

  • EPSS 0.15%
  • Veröffentlicht 30.06.2020 17:15:10
  • Zuletzt bearbeitet 21.11.2024 05:04:46

In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local storage mechanism, including credentials. A malicious user with direct access to the browser could extract the ema...

5.3

CVE-2020-7964

  • EPSS 0.32%
  • Veröffentlicht 24.01.2020 20:15:11
  • Zuletzt bearbeitet 21.11.2024 05:38:06

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous ...

5.3

CVE-2019-1010304

Exploit
  • EPSS 0.33%
  • Veröffentlicht 15.07.2019 15:15:11
  • Zuletzt bearbeitet 21.11.2024 04:18:08

Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This commit was released as part of 2.0.0 release is affected by: Incorrect Access Control. The impact is: Important. The component is: ProductVariant type in Grap...

8.8

CVE-2019-13594

  • EPSS 0.14%
  • Veröffentlicht 14.07.2019 17:15:11
  • Zuletzt bearbeitet 21.11.2024 04:25:17

In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid CSRF token and be accepted by the server.