CVE-2024-29036 json
Saleor Storefront session leak in cache
published 2024-03-20 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-26085
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
Saleor Storefront is software for building e-commerce experiences. Prior to commit 579241e75a5eb332ccf26e0bcdd54befa33f4783, when any user authenticates in the storefront, anonymous users are able to access their data. The session is leaked through cache and can be accessed by anyone. Users should upgrade to a version that incorporates commit 579241e75a5eb332ccf26e0bcdd54befa33f4783 or later to receive a patch. A possible workaround is to temporarily disable authentication by changing the usage of `createSaleorAuthClient()`.
Patch / fix
- saleor react-storefront 1.0.2
- github.com/saleor/auth-sdk@56db134 commit
- github.com/saleor/storefront@579241e commit
- github.com/saleor/saleor-docs#1120 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
Affected products
- saleor storefront
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/saleor/saleor-docs/pull/1120
issue-tracking
-
github.com
/saleor/auth-sdk/commit/56db13407aa35d00b85ec2df042692edd4aea9da
patch
-
github.com
/saleor/storefront/commit/579241e75a5eb332ccf26e0bcdd54befa33f4783
patch
-
github.com
/saleor/storefront/security/advisories/GHSA-52cq-c7x7-cqw4
vendor-advisory
Sources
- CVE List CVE-2024-29036
- NVD CVE-2024-29036
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.