Read the docs
TI-2024-19218 Aliases CVE-2024-29036

Saleor Storefront session leak in cache

Priority LOW 30CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

Saleor Storefront is software for building e-commerce experiences. Prior to commit 579241e75a5eb332ccf26e0bcdd54befa33f4783, when any user authenticates in the storefront, anonymous users are able to access their data. The session is leaked through cache and can be accessed by anyone. Users should upgrade to a version that incorporates commit 579241e75a5eb332ccf26e0bcdd54befa33f4783 or later to receive a patch. A possible workaround is to temporarily disable authentication by changing the usage of `createSaleorAuthClient()`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0057 47th percentileScored 2026-11-07
Fix Fixed storefront (saleor): 579241e75a5eb332ccf26e0bcdd54befa33f4783

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
saleorstorefrontbefore 579241e75a5eb332ccf26e0bcdd54befa33f4783579241e75a5eb332ccf26e0bcdd54befa33f4783Patch availableCNA
  • storefront Vendorsaleor Affected before 579241e75a5eb332ccf26e0bcdd54befa33f4783 Fixed in 579241e75a5eb332ccf26e0bcdd54befa33f4783 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:saleor:react-storefront:*:*:*:*:*:*:*:*before 1.0.2Vulnerablesaleor
  • cpe:2.3:a:saleor:react-storefront:*:*:*:*:*:*:*:* Versions before 1.0.2 Vulnerable ·saleor

Remediation

  • Fix · CNA storefront (saleor) Fixed in 579241e75a5eb332ccf26e0bcdd54befa33f4783

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-29036

References

Patch 2

Advisory 1

Other 1

  • TI-2023-03083 Cross-site Scripting (XSS) - DOM in saleor/react-storefront CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences