GitHub Advisoryadvisory · PyPI

GHSA-rgcm-rpq9-9cgr Missing Authentication for Critical Function in Saleor

MEDIUM Published 2021-07-28 Modified 2021-07-27 Official page ↗
Aliases
CVE-2020-7964
Ecosystem
PyPI
Packages
saleor
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-306
Reviewed
2021-07-27

Affected packages

• PyPI saleor: >= 2.0.0, < 2.9.1 → fixed in 2.9.1

Description

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer).

Related

Alias · CVE (1)

  • CVE-2020-7964 An issue was discovered in Mirumee Saleor 2.x before 2.9.1. vulnerability

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References