Improper Authorization Affecting saleor package, versions [0,]
Threat Intelligence
EPSS
0.05% (21st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-SALEOR-3041000
- published 7 Oct 2022
- disclosed 7 Oct 2022
- credit Unknown
Introduced: 7 Oct 2022
CVE-2022-39275 Open this link in a new tabHow to fix?
There is no fixed version for saleor.
Overview
Affected versions of this package are vulnerable to Improper Authorization due to not properly checking the ID type input which allowed to access database objects that the authenticated user may not be allowed to access.
Note
This vulnerability can be used to expose the following information: Estimating database row counts from tables with a sequential primary key or Exposing staff user and customer email addresses and full name through the assignNavigation() mutation.
References
CVSS Scores
version 3.1