GHSA-rgcm-rpq9-9cgr

Missing Authentication for Critical Function in Saleor

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-7964

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	saleor	>= 2.0.0, < 2.9.1	2.9.1

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-7964 advisory
https://github.com/mirumee/saleor/commit/233b8890c60fa6d90daf99e4d90fea85867732c3 web
https://github.com/mirumee/saleor/releases/tag/2.9.1 web