CVE-2024-29888: Saleor information leak in Local stock only pickup method

CVE-2024-29888 · Severity: medium · CVSS 4.2 · Published 2024-03-28

Saleor is an e-commerce platform used by high-volume businesses to manage online stores. A flaw in the 'Local stock only' pickup delivery method allows a customer's private home address to accidentally overwrite a warehouse's public address. This results in the exposure of private customer location data to other users or the public, potentially impacting customer privacy and the company's reputation for data handling.

Technologies: saleor (PyPI), Saleor. Vendors: PyPI, Saleor.

Quick answers

Is CVE-2024-29888 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-29888 being exploited in the wild.
How severe is CVE-2024-29888?
Medium severity, with a CVSS score of 4.2, published 28 March 2024.
Which products and versions are affected?
saleor (PyPI) ECOSYSTEM:introduced=3.14.56,fixed=3.14.61, ECOSYSTEM:introduced=3.14.56,fixed=3.14.61,introduced=3.15.31,fixed=3.15.37,introduced=3.16.27,fixed=3.16.34,introduced=3.17.25,fixed=3.17.32,introduced=3.18.19,fixed=3.18.28,introduced=3.19.5,fixed=3.19.15; Saleor >= 3.14.56, < 3.14.61; >= 3.15.31, < 3.15.37; >= 3.16.27, < 3.16.34; >= 3.17.25, < 3.17.32; >= 3.18.19, < 3.18.28; >= 3.19.5, < 3.19.15.
Is there a fix for CVE-2024-29888?
Yes. saleor (PyPI): upgrade to 3.14.61, 3.19.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-29888 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2024-29888?
Check whether you run saleor (PyPI) or Saleor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • saleor (PyPI): upgrade to 3.14.61, 3.19.15 or later
    pip install "saleor>=3.19.15"

Technical details

A vulnerability exists in Saleor's click-and-collect functionality, specifically when using the 'Pickup: Local stock only' delivery method. Under certain conditions, a customer's address can overwrite the warehouse address in the system, leading to the exposure of private personal information (CWE-359). The attack vector is network-based but requires high complexity and user interaction to trigger the specific conditions for the address overwrite. Successful exploitation results in a loss of confidentiality for customer data. Patches are available in versions 3.14.61, 3.15.37, 3.16.34, 3.17.32, 3.18.28, and 3.19.15.

Affected products

  • Saleor Saleor >= 3.14.56, < 3.14.61; >= 3.15.31, < 3.15.37; >= 3.16.27, < 3.16.34; >= 3.17.25, < 3.17.32; >= 3.18.19, < 3.18.28; >= 3.19.5, < 3.19.15

Identifiers

  • CVE-2024-29888
  • GHSA-mrj3-f2h4-7w45
  • PYSEC-2026-1890

Timeline

  • 2024-03-27: disclosed
  • 2024-03-27: patched
  • 2024-03-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.