Vulnerabilities

TI-2020-11863 CVE-2020-15085

Client caching login operation with plaintext password in Saleor Storefront

LOW 31

In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local storage mechanism, including credentials.

CVSS 3.1MEDIUM 6.9 Network No auth User interaction EPSS 0.00577 Published 2020-06-30 Fixed in 2.10.3 CWE-312

TI-2020-06442 CVE-2020-7964 · GHSA-rgcm-rpq9-9cgr

An issue was discovered in Mirumee Saleor 2.x before 2.9.1.

LOW 26

An issue was discovered in Mirumee Saleor 2.x before 2.9.1.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01092 Published 2020-01-24 Fixed in 2.9.1 CWE-306

TI-2019-16068 CVE-2019-1010304 · GHSA-9r7g-8c57-3gxp

Missing authorization in Saleor

LOW 26

Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01171 Published 2019-07-15 No fix listed CWE-862

TI-2019-10217 CVE-2019-13594 · GHSA-fgjh-x3f8-8gmh

In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally…

LOW 39

In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid CSRF token and be accepted by the server.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00618 Published 2019-07-14 Fixed in 2.8.0 CWE-352

Vulnerabilities

Filters

Client caching login operation with plaintext password in Saleor Storefront

An issue was discovered in Mirumee Saleor 2.x before 2.9.1.

Missing authorization in Saleor

In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally…