Homepage
About Snyk

saleor@2.10.1 vulnerabilities

A modular, high performance e-commerce storefront built with GraphQL, Django, and ReactJS.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the saleor package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Information Exposure

Affected versions of this package are vulnerable to Information Exposure due to the validate_hmac_signature function being vulnerable to timing attacks. Malicious users could abuse this vulnerability on Saleor deployments having the Adyen plugin enabled in order to determine the secret key and forge fake events. This could affect the database integrity such as marking an order as paid when it is not.

How to fix Information Exposure?

A fix was pushed into the master branch but not yet published.

[0,)
  • M
Information Exposure

Affected versions of this package are vulnerable to Information Exposure such that some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests.

How to fix Information Exposure?

A fix was pushed into the master branch but not yet published.

[0,)
  • L
Information Exposure

Affected versions of this package are vulnerable to Information Exposure such that some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests.

How to fix Information Exposure?

A fix was pushed into the master branch but not yet published.

[0,)
  • M
Improper Authorization

Affected versions of this package are vulnerable to Improper Authorization due to not properly checking the ID type input which allowed to access database objects that the authenticated user may not be allowed to access.

Note This vulnerability can be used to expose the following information: Estimating database row counts from tables with a sequential primary key or Exposing staff user and customer email addresses and full name through the assignNavigation() mutation.

How to fix Improper Authorization?

There is no fixed version for saleor.

[0,)
  • M
Incorrect Authorization

Affected versions of this package are vulnerable to Incorrect Authorization due to missing permission checks.

How to fix Incorrect Authorization?

A fix was pushed into the master branch but not yet published.

[0,)
Go back to all versions of this package