CVE-2019-1010304 Missing authorization in Saleor

Medium 5.3 Published 15 Jul 2019 Updated 5 Aug 2024

Unauthenticated users can access the GraphQL API to retrieve restricted product and revenue data due to missing authorization checks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-1010304?

CVE-2019-1010304 is a medium-severity missing authorization vulnerability in Saleor, published on 15 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This commit was released as part of 2.0.0 release is affected by: Incorrect Access Control. The impact is: Important. The component is: ProductVariant type in GraphQL API. The attack vector is: Unauthenticated user can access the GraphQL API (which is by default publicly exposed under `/graphql/` URL) and fetch products data which may include admin-restricted shop's revenue data. The fixed version is: 2.3.1.

Weakness: CWE-862

Which versions are affected by CVE-2019-1010304?

It affects 1 product.

Products include Mirumee Saleor.

How do I fix CVE-2019-1010304?

No fix has been published for CVE-2019-1010304 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-1010304 being exploited?

There is no known exploitation of CVE-2019-1010304 in the wild and no public exploit code.

Sources

Also known as GHSA-9r7g-8c57-3gxp.