Read the docs
TI-2020-11863 Aliases CVE-2020-15085

Client caching login operation with plaintext password in Saleor Storefront

Priority LOW 31CWE-312Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-312.

Summary

In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local storage mechanism, including credentials. A malicious user with direct access to the browser could extract the email and password. In versions prior to 2.10.0 persisted the cache even after the user logged out. This is fixed in version 2.10.3. A workaround is to manually clear application data (browser's local storage) after logging into Saleor Storefront.

Why it matters now

EPSS 0.00577 47th percentileScored 2026-11-07
Fix Fixed saleor-storefront (mirumee): 2.10.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
mirumeesaleor-storefrontbefore 2.10.32.10.3Patch availableCNA
  • saleor-storefront Vendormirumee Affected before 2.10.3 Fixed in 2.10.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mirumee:saleor:*:*:*:*:*:*:*:*before 2.10.3Vulnerablemirumee
  • cpe:2.3:a:mirumee:saleor:*:*:*:*:*:*:*:* Versions before 2.10.3 Vulnerable ·mirumee

Remediation

  • Fix · CNA saleor-storefront (mirumee) Fixed in 2.10.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15085

References

Patch 1

Advisory 2

  • TI-2019-10217 In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally… CVSS 3.0HIGH 8.8
  • TI-2020-06442 An issue was discovered in Mirumee Saleor 2.x before 2.9.1. CVSS 3.1MEDIUM 5.3
  • TI-2019-16068 Missing authorization in Saleor CVSS 3.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences