PT-2023-33025 · Vendure+1 · Vendure+1

Publicado 2023-07-11 · Atualizado 2023-07-11

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Vendure (affected versions not specified)

Description The issue concerns the default cookie settings in Vendure, an e-commerce GraphQL framework, which are insecure due to the SameSite setting being false by default. This setting originates from the cookie-session npm package’s default settings.

Recommendations For all affected versions, manually set the authOptions.cookieOptions.sameSite configuration option to 'strict', 'lax', or true as a workaround. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

GHSA-H9WQ-XCQX-MQXM

Produtos afetados

Vendure

Cookie-Session

Referências · 4

• https://github.com/vendure-ecommerce/vendure/security/advisories/GHSA-h9wq-xcqx-mqxm · Nota
• https://github.com/vendure-ecommerce/vendure/commit/4a10d6785a3bf792ddf84053cdf232c205b82c81 · Nota
• https://github.com/vendure-ecommerce/vendure · Nota
• https://osv.dev/vulnerability/GHSA-h9wq-xcqx-mqxm · Aviso do Fabricante