GoogleOSV:CVE-2024-29888

HistoryMar 27, 2024 - 7:15 p.m.

CVE-2024-29888

2024-03-2719:15:49

Google

osv.dev

saleor

e-commerce

vulnerability

pickup

address overwrite

patch

software

CVSS3

4.2

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

AI Score

Confidence

Low

EPSS

Percentile

13.0%

JSON

Saleor is an e-commerce platform that serves high-volume companies. When using Pickup: Local stock only click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes its address as click-and-collect address. This issue has been patched in versions: 3.14.61, 3.15.37, 3.16.34, 3.17.32, 3.18.28, 3.19.15.

References

github.com/saleor/saleor/commit/22a1aa3ef0bc54156405f69146788016a7f3f761

github.com/saleor/saleor/commit/39abb0f4e4fe6503f81bfbb871227e4f70bcdd5c

github.com/saleor/saleor/commit/47cedfd7d6524d79bdb04708edcdbb235874de6b

github.com/saleor/saleor/commit/997f7ea4f576543ec88679a86bfe1b14f7f2ff26

github.com/saleor/saleor/commit/b7cecda8b603f7472790150bb4508c7b655946d4

github.com/saleor/saleor/commit/d8ba545c16ad3153febc5b5be8fd2ef75da9fc95

github.com/saleor/saleor/commit/dccc2c842b4e2e09470929c80f07dc137e439182

github.com/saleor/saleor/commit/ef003c76a304c89ddb2dc65b7f1d5b3b2ba1c640

github.com/saleor/saleor/pull/15694

github.com/saleor/saleor/pull/15697

github.com/saleor/saleor/security/advisories/GHSA-mrj3-f2h4-7w45

CVSS3

4.2

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

AI Score

Confidence

Low

EPSS

Percentile

13.0%

JSON

Related for OSV:CVE-2024-29888