CVE-2024-29036
Medium
Description
Saleor Storefront is software for building e-commerce experiences. Prior to commit 579241e75a5eb332ccf26e0bcdd54befa33f4783, when any user authenticates in the storefront, anonymous users are able to access their data. The session is leaked through cache and can be accessed by anyone. Users should upgrade to a version that incorporates commit 579241e75a5eb332ccf26e0bcdd54befa33f4783 or later to receive a patch. A possible workaround is to temporarily disable authentication by changing the usage of `createSaleorAuthClient()`.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Saleor React-storefront
PublishedMar 20, 2024
First seenMar 20, 2024
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- saleor react-storefront1.0.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| saleor react-storefront | v < 1.0.2 | 1.0.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.