GitHub Advisoryadvisory · PyPI

GHSA-fgjh-x3f8-8gmh Mirumee Saleor CSRF Protection Disabled

HIGH Published 2022-05-24 Modified 2023-08-01 Official page ↗
Aliases
CVE-2019-13594
Ecosystem
PyPI
Packages
saleor
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2023-08-01

Affected packages

• PyPI saleor: >= 2.7.0, < 2.8.0 → fixed in 2.8.0

Description

In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid CSRF token and be accepted by the server.

Related

Alias · CVE (1)

  • CVE-2019-13594 In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References