CVE-2020-7964 | BDVDB-2026-129696 Detail

Description#

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer).

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/mirumee/saleor/commit/233b8890c60fa6d90daf99e4d90fea85867732c3
https://github.com/mirumee/saleor/releases/tag/2.9.1

Exploit#

No public exploit known

History#

Version 12020-01-24Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.