Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1mZ2poLXgzZjgtOGdtaM4AAhSU

Mirumee Saleor CSRF Protection Disabled

In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid CSRF token and be accepted by the server.

Permalink: https://github.com/advisories/GHSA-fgjh-x3f8-8gmh
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mZ2poLXgzZjgtOGdtaM4AAhSU
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: over 1 year ago

CVSS Score: 8.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Percentage: 0.00073
EPSS Percentile: 0.325

Identifiers: GHSA-fgjh-x3f8-8gmh, CVE-2019-13594
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-13594
• https://github.com/mirumee/saleor/commit/94c07034ff1bfc209461e39ca1bb6228d8ca0e35
• http://web.archive.org/web/20190713094847/https://github.com/mirumee/saleor/releases/tag/2.8.0
• https://github.com/advisories/GHSA-fgjh-x3f8-8gmh

Repository: https://github.com/mirumee/saleor
Blast Radius: 2.6

Affected Packages