CVE-2019-13594: Cross-Site Request Forgery (CSRF)

May 24, 2022 (updated August 1, 2023)

In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid CSRF token and be accepted by the server.

References

web.archive.org/web/20190713094847/https://github.com/mirumee/saleor/releases/tag/2.8.0
github.com/advisories/GHSA-fgjh-x3f8-8gmh
github.com/mirumee/saleor/commit/94c07034ff1bfc209461e39ca1bb6228d8ca0e35
nvd.nist.gov/vuln/detail/CVE-2019-13594

Code Behaviors & Features

Detect and mitigate CVE-2019-13594 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →