CVE-2024-29036: Saleor Storefront session leak in cache
Saleor Storefront is software for building e-commerce experiences. Prior to commit 579241e75a5eb332ccf26e0bcdd54befa33f4783, when any user authenticates in the storefront, anonymous users are able to access their data. The session is leaked through cache and can be accessed by anyone. Users should upgrade to a version that incorporates commit 579241e75a5eb332ccf26e0bcdd54befa33f4783 or later to receive a patch. A possible workaround is to temporarily disable authentication by changing the usage of createSaleorAuthClient().
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29036?
CVE-2024-29036 is considered a high severity vulnerability due to its potential to leak sensitive user session data.
How do I fix CVE-2024-29036?
To fix CVE-2024-29036, upgrade the Saleor Storefront software to a version later than commit 579241e75a5eb332ccf26e0bcdd54befa33f4783.
What does CVE-2024-29036 affect?
CVE-2024-29036 affects the Saleor Storefront prior to the specified commit, allowing unauthorized access to authenticated user data.
Who is affected by CVE-2024-29036?
All Saleor Storefront users who have not updated their version to include the fix are at risk from CVE-2024-29036.
What type of vulnerability is CVE-2024-29036?
CVE-2024-29036 is a session management vulnerability that allows anonymous users to access authenticated session data.