CVE-2024-29888 MEDIUM

CVE-2024-29888: Saleor vulnerable to customers addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method

Vendor Saleor
Product saleor
Weakness CWE-359
Published March 27, 2024
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

4.2/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Saleor is an e-commerce platform that serves high-volume companies. When using `Pickup: Local stock only` click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes its address as click-and-collect address. This issue has been patched in versions: `3.14.61`, `3.15.37`, `3.16.34`, `3.17.32`, `3.18.28`, `3.19.15`.

Key dates

02Disclosure timeline

March 27, 2024 CVE published
August 2, 2024 Record updated