CVE Feed

    Dashboard / CVE / CVE-2019-1010304

    CVE-2019-1010304

    Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This commit was released as part of 2.0.0 release is affected by: Incorrect Access Control. The impact is: Important. The component is: ProductVariant type in GraphQL API. The attack vector is: Unauthenticated user can access the GraphQL API (which is by default publicly exposed under `/graphql/` URL) and fetch products data which may include admin-restricted shop's revenue data. The fixed version is: 2.3.1.

    Published:Jul 15, 2019
    Last Modified:Nov 21, 2024
    EPS:Jul 15, 2019
    EPSS Score:0.00389
    CVSS Score:5.3

    Affected Products

    Vendor
    Mirumee
    Product
    Saleor

    Exploits

    https://github.com/mirumee/saleor/issues/3768https://github.com/mirumee/saleor/issues/3768

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High