CVE-2020-7964: Medium severity Mirumee Saleor vulnerability
Published Jan 24, 2020
·Updated
An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer).
Affected Software
1 affected component
Mirumee Saleor>=2.0.0<2.9.1
Remediation
Event History
Jan 24, 2020
CVE Published
via MITRE·07:38 PM
Data Sourced
via MITRE·07:38 PM
Description
Data Sourced
via NVD·08:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Who can exploit this issue, and what access do they need?
Saleor 2.x deployments before 2.9.1 are affected. The issue is remotely exploitable with no authentication or user interaction required, according to the CVSS vector.
2
What data could be exposed if the vulnerability is exploited?
An attacker can attach a checkout they control to an arbitrary user ID. This can expose another customer's name, address, and previous orders.
3
What is the recommended remediation?
Update Saleor to version 2.9.1 or later, which includes the available patch.