CVE-2019-13594: CSRF
Published Jul 14, 2019
·Updated
In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid CSRF token and be accepted by the server.
Affected Software
2 affected componentsFixes available
pip/saleor=2.7.0
2.8.0
Mirumee Saleor=2.7.0
Event History
Jul 14, 2019
CVE Published
via MITRE·04:19 PM
Data Sourced
via MITRE·04:19 PM
Description
May 24, 2022
Advisory Published
04:50 PM
Frequently Asked Questions
1
Which Saleor versions are affected and fixed?
Mirumee Saleor version 2.7.0 is affected. The issue was fixed in version 2.8.0.
2
What does an attacker need to exploit this issue?
An attacker can submit a POST request that lacks a valid CSRF token, and the server may accept it. The supplied data does not identify any additional authentication or access prerequisites.
3
Are default Saleor 2.7.0 deployments affected?
The CSRF protection middleware was accidentally disabled in the affected version, so deployments of Saleor 2.7.0 should be treated as affected unless they have applied the upstream fix or upgraded.