What is CVE-2020-7964?

CVE-2020-7964 is a medium-severity vulnerability in Mirumee Saleor, classified under Missing Authentication for Critical Function. CVSS score: 5.3/10. Published 2020-01-24.

How severe is CVE-2020-7964?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Auth bypass in Mirumee Saleor

CVE-2020-7964

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer).

Vulnerability class: Broken Authentication

EPSS: 0.011 (61.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Mirumee Saleor
N/a — versions n/a

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

cve@mitre.org (Patch, x_refsource_MISC)
cve@mitre.org (x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2020-7964?: CVE-2020-7964 is a medium-severity vulnerability in Mirumee Saleor, classified under Missing Authentication for Critical Function. CVSS score: 5.3/10. Published 2020-01-24.
How severe is CVE-2020-7964?: Medium severity. CVSS v3 base score is 5.3 out of 10.