CVE-2022-39275
Description
Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input which allowed to access database objects that the authenticated user may not be allowed to access. This vulnerability can be used to expose the following information: Estimating database row counts from tables with a sequential primary key or Exposing staff user and customer email addresses and full name through the `assignNavigation()` mutation. This issue has been patched in main and backported to multiple releases (3.7.17, 3.6.18, 3.5.23, 3.4.24, 3.3.26, 3.2.14, 3.1.24). Users are advised to upgrade. There are no known workarounds for this issue.
How to fix
- saleor saleor3.1.24, 3.2.14, 3.3.26, 3.4.24, 3.5.23, 3.6.18, 3.7.17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| saleor saleor | 2.0.0 ≤ v < 3.1.24, 3.2.0 ≤ v < 3.2.14, 3.3.0 ≤ v < 3.3.26, 3.4.0 ≤ v < 3.4.24, 3.5.0 ≤ v < 3.5.23, 3.6.0 ≤ v < 3.6.18, 3.7.0 ≤ v < 3.7.17 | 3.1.24, 3.2.14, 3.3.26, 3.4.24, 3.5.23, 3.6.18, 3.7.17 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.