PT-2019-13441 · Mirumee · Mirumee Saleor

Published 2019-07-14 · Updated 2022-05-24 · CVE-2019-13594

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mirumee Saleor versions prior to 2.8.0

Description The issue concerns the accidental disabling of CSRF protection middleware, allowing attackers to send a POST request without a valid CSRF token. This enables the server to accept such requests.

Recommendations For versions prior to 2.8.0, update to version 2.8.0 or later to resolve the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-13594

GHSA-FGJH-X3F8-8GMH

Affected Products

Mirumee Saleor

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-13594 · Security Note
• https://osv.dev/vulnerability/GHSA-fgjh-x3f8-8gmh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-13594 · Vendor Advisory
• https://github.com/mirumee/saleor/releases/tag/2.8.0 · Note
• https://github.com/mirumee/saleor/commit/94c07034ff1bfc209461e39ca1bb6228d8ca0e35 · Note
• http://web.archive.org/web/20190713094847/https://github.com/mirumee/saleor/releases/tag/2.8.0 · Note