Information Exposure Affecting saleor package, versions [,2.10.1)
Threat Intelligence
EPSS
0.09% (40th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-SALEOR-1534850
- published 29 Jul 2021
- disclosed 28 Jul 2021
- credit Unknown
How to fix?
Upgrade saleor to version 2.10.1 or higher.
Overview
Affected versions of this package are vulnerable to Information Exposure. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data such as the name, address, and previous orders of any customer.
References
CVSS Scores
version 3.1