CVE-2024-29888
- Source
- https://cve.org/CVERecord?id=CVE-2024-29888
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-29888.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-29888
- Aliases
- Published
- 2024-03-27T18:53:44.698Z
- Modified
- 2026-07-15T01:48:53.393497793Z
- Severity
-
- 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- Saleor vulnerable to customers addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method
- Details
-
Saleor is an e-commerce platform that serves high-volume companies. When using
Pickup: Local stock onlyclick-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes its address as click-and-collect address. This issue has been patched in versions:3.14.61,3.15.37,3.16.34,3.17.32,3.18.28,3.19.15. - Database specific
{ "cwe_ids": [ "CWE-359" ], "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29888.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29888.json
- https://github.com/saleor/saleor/security/advisories/GHSA-mrj3-f2h4-7w45
- https://nvd.nist.gov/vuln/detail/CVE-2024-29888
- https://github.com/saleor/saleor/commit/22a1aa3ef0bc54156405f69146788016a7f3f761
- https://github.com/saleor/saleor/commit/39abb0f4e4fe6503f81bfbb871227e4f70bcdd5c
- https://github.com/saleor/saleor/commit/47cedfd7d6524d79bdb04708edcdbb235874de6b
- https://github.com/saleor/saleor/commit/997f7ea4f576543ec88679a86bfe1b14f7f2ff26
- https://github.com/saleor/saleor/commit/b7cecda8b603f7472790150bb4508c7b655946d4
- https://github.com/saleor/saleor/commit/d8ba545c16ad3153febc5b5be8fd2ef75da9fc95
- https://github.com/saleor/saleor/commit/dccc2c842b4e2e09470929c80f07dc137e439182
- https://github.com/saleor/saleor/commit/ef003c76a304c89ddb2dc65b7f1d5b3b2ba1c640
- https://github.com/saleor/saleor/pull/15694
- https://github.com/saleor/saleor/pull/15697
Affected packages
Git / github.com/saleor/saleor
Affected ranges
- Type
- GIT
- Repo
- https://github.com/saleor/saleor
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedFixedFixedFixedFixedFixedFixedFixedFixed
- Database specific
{ "cpe": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "3.14.56" }, { "fixed": "3.14.61" }, { "introduced": "3.15.31" }, { "fixed": "3.15.37" }, { "introduced": "3.16.27" }, { "fixed": "3.16.34" }, { "introduced": "3.17.25" }, { "fixed": "3.17.32" }, { "introduced": "3.18.19" }, { "fixed": "3.18.28" }, { "introduced": "3.19.5" }, { "fixed": "3.19.15" } ], "source": [ "CPE_RANGE", "REFERENCES" ] }
Affected versions
3.*
3.14.56
3.14.57
3.14.58
3.14.59
3.14.60
3.15.31
3.15.32
3.15.33
3.15.34
3.15.35
3.15.36
3.16.27
3.16.28
3.16.29
3.16.30
3.16.31
3.16.32
3.16.33
3.17.25
3.17.26
3.17.27
3.17.28
3.17.29
3.17.30
3.17.31
3.18.19
3.18.20
3.18.21
3.18.22
3.18.23
3.18.24
3.18.25
3.18.26
3.18.27
3.19.10
3.19.11
3.19.12
3.19.13
3.19.14
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9