Home > Vulnerability Database > CVE-2024-29888

Mend.io Vulnerability Database

CVE-2024-29888

Good to know:

Date: March 27, 2024

Saleor is an e-commerce platform that serves high-volume companies. When using `Pickup: Local stock only` click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes its address as click-and-collect address. This issue has been patched in versions: `3.14.61`, `3.15.37`, `3.16.34`, `3.17.32`, `3.18.28`, `3.19.15`.

Language: Python

Severity Score

4.2

Related Resources (20)

Url: https://github.com/saleor/saleor/pull/15694

Url: https://github.com/saleor/saleor/releases/tag/3.14.61

Url: https://github.com/saleor/saleor/releases/tag/3.17.32

Url: https://github.com/saleor/saleor/commit/b7cecda8b603f7472790150bb4508c7b655946d4

Url: https://github.com/saleor/saleor/commit/d8ba545c16ad3153febc5b5be8fd2ef75da9fc95

Url: https://github.com/saleor/saleor/commit/22a1aa3ef0bc54156405f69146788016a7f3f761

Url: https://github.com/saleor/saleor/commit/dccc2c842b4e2e09470929c80f07dc137e439182

Url: https://github.com/saleor/saleor/commit/39abb0f4e4fe6503f81bfbb871227e4f70bcdd5c

Url: https://github.com/saleor/saleor/commit/47cedfd7d6524d79bdb04708edcdbb235874de6b

Url: https://github.com/saleor/saleor/releases/tag/3.16.34

Url: https://github.com/saleor/saleor

Url: https://github.com/saleor/saleor/security/advisories/GHSA-mrj3-f2h4-7w45

Url: https://github.com/saleor/saleor/commit/997f7ea4f576543ec88679a86bfe1b14f7f2ff26

Url: https://github.com/saleor/saleor/releases/tag/3.19.15

Url: https://github.com/saleor/saleor/pull/15697

Url: https://github.com/saleor/saleor/releases/tag/3.15.37

Url: https://nvd.nist.gov/vuln/detail/CVE-2024-29888

Url: https://github.com/saleor/saleor/releases/tag/3.18.28

Url: https://github.com/saleor/saleor/commit/ef003c76a304c89ddb2dc65b7f1d5b3b2ba1c640

Url: https://www.mend.io/vulnerability-database/CVE-2024-29888

Severity Score

4.2

Weakness Type (CWE)

Exposure of Private Personal Information to an Unauthorized Actor

CWE-359

Top Fix

Upgrade Version

Upgrade to version 3.14.61,3.15.37,3.16.34,3.17.32,3.18.28,3.19.15

Learn More

CVSS v3.1

Base Score:	4.2
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	REQUIRED
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	NONE

Mend.io Vulnerability Database

We found results for “”

CVE-2024-29888

Good to know:

Date: March 27, 2024

Language: Python

Severity Score

Related Resources (20)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

Do you need more information?