CVE-2024-29888 Saleor vulnerable to customers addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method
Attackers can leak their own addresses by overwriting warehouse data in specific click-and-collect configurations, exposing sensitive customer information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-29888?
CVE-2024-29888 is a medium-severity vulnerability in saleor, published on 27 Mar 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Saleor is an e-commerce platform that serves high-volume companies. When using `Pickup: Local stock only` click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes its address as click-and-collect address. This issue has been patched in versions: `3.14.61`, `3.15.37`, `3.16.34`, `3.17.32`, `3.18.28`, `3.19.15`.
Weakness: CWE-359
Which versions are affected by CVE-2024-29888?
13 open source packages ship an affected version, including saleor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
saleor PyPI | From 3.14.56 | 3.14.61, 3.15.37, 3.16.34, 3.17.32, 3.18.28, 3.19.15 |
saleor PyPI | From 3.14.56 | 3.14.61 |
saleor PyPI | From 3.14.56 | 3.14.61 |
saleor PyPI | From 3.15.31 | 3.15.37 |
saleor PyPI | From 3.15.31 | 3.15.37 |
saleor PyPI | From 3.16.27 | 3.16.34 |
7 more packages
saleor PyPI | From 3.16.27 | 3.16.34 |
saleor PyPI | From 3.17.25 | 3.17.32 |
saleor PyPI | From 3.17.25 | 3.17.32 |
saleor PyPI | From 3.18.19 | 3.18.28 |
saleor PyPI | From 3.18.19 | 3.18.28 |
saleor PyPI | From 3.19.5 | 3.19.15 |
saleor PyPI | From 3.19.5 | 3.19.15 |
Products include Saleor Saleor.
How do I fix CVE-2024-29888?
Upgrade saleor to a fixed version for your release line: 3.14.61, 3.15.37, 3.16.34 or 3.17.32.
Is CVE-2024-29888 being exploited?
There is no known exploitation of CVE-2024-29888 in the wild and no public exploit code.
Other vulnerabilities in saleor
- CVE-2026-24136 Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API
- CVE-2026-23499 Saleor vulnerable to stored XSS via Unrestricted File Upload
- CVE-2026-33756 Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching
- CVE-2026-35401 Saleor has a resource exhaustion vulnerability in GraphQL queries
- CVE-2026-22849 Saleor lacks proper HTML sanitization in rich text fields
Sources
Also known as GHSA-mrj3-f2h4-7w45, PYSEC-2026-1890.