CVE-2019-1010304
Medium
Description
Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This commit was released as part of 2.0.0 release is affected by: Incorrect Access Control. The impact is: Important. The component is: ProductVariant type in GraphQL API. The attack vector is: Unauthenticated user can access the GraphQL API (which is by default publicly exposed under `/graphql/` URL) and fetch products data which may include admin-restricted shop's revenue data. The fixed version is: 2.3.1.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Mirumee Saleor
PublishedJul 15, 2019
First seenJul 15, 2019
How to fix
Update
- mirumee saleor2.3.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mirumee saleor | 2.0.0 ≤ v < 2.3.1 | 2.3.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.