Lucene search

DwfCVE-2019-1010304

HistoryJul 15, 2019 - 3:15 p.m.

CVE-2019-1010304

2019-07-1515:15:11

CWE-862

dwf

web.nvd.nist.gov

cve

2019

1010304

saleor

issue

merge commit

access control

productvariant

graphql api

unauthenticated user

fixed version

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

44.7%

JSON

Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This commit was released as part of 2.0.0 release is affected by: Incorrect Access Control. The impact is: Important. The component is: ProductVariant type in GraphQL API. The attack vector is: Unauthenticated user can access the GraphQL API (which is by default publicly exposed under /graphql/ URL) and fetch products data which may include admin-restricted shop’s revenue data. The fixed version is: 2.3.1.

Affected configurations

Nvd

Node

mirumeesaleorRange2.0.0–2.3.1

VendorProductVersionCPE
mirumeesaleor*cpe:2.3:a:mirumee:saleor:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mirumee	saleor	*	cpe:2.3:a:mirumee:saleor::::::::

CNA Affected

[
  {
    "product": "Saleor",
    "vendor": "Saleor",
    "versions": [
      {
        "status": "affected",
        "version": "Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This commit was released as part of 2.0.0 release [fixed: 2.3.1]"
      }
    ]
  }
]

References

github.com/mirumee/saleor/issues/3768

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

44.7%

JSON

Related for CVE-2019-1010304