SB2019071513 - Improper access control in Saleor

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019071513

SB2019071513 - Improper access control in Saleor

Published: July 15, 2019 Updated: July 17, 2020

Security Bulletin ID SB2019071513
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Improper access control (CVE-ID: CVE-2019-1010304)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This commit was released as part of 2.0.0 release is affected by: Incorrect Access Control. The impact is: Important. The component is: ProductVariant type in GraphQL API. The attack vector is: Unauthenticated user can access the GraphQL API (which is by default publicly exposed under `/graphql/` URL) and fetch products data which may include admin-restricted shop's revenue data. The fixed version is: 2.3.1.


Remediation

Install update from vendor's website.

References