← Vulnerability feed

Vulnerability record · CVE-2024-29888 · published 27 March 2024

CVE-2024-29888: Saleor vulnerability

Saleor · Saleor

Saleor is an e-commerce platform that serves high-volume companies. When using `Pickup: Local stock only` click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes its address as click-and-collect address. This issue has been patched in versions: `3.14.61`, `3.15.37`, `3.16.34`, `3.17.32`, `3.18.28`, `3.19.15`.

5.4 CVSS 3.1 Medium EPSS 0.53% · top 57.2% CWE-359 · CWE-359
5.4CVSS 3.1 base score
0.53%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
22References
17 Jun 2026Last modified by NVD

Description

Saleor is an e-commerce platform that serves high-volume companies. When using `Pickup: Local stock only` click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes its address as click-and-collect address. This issue has been patched in versions: `3.14.61`, `3.15.37`, `3.16.34`, `3.17.32`, `3.18.28`, `3.19.15`.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/saleor/saleor/commit/22a1aa3ef0bc54156405f69146788016a7f3f761 Patch
https://github.com/saleor/saleor/commit/39abb0f4e4fe6503f81bfbb871227e4f70bcdd5c Patch
https://github.com/saleor/saleor/commit/47cedfd7d6524d79bdb04708edcdbb235874de6b Patch
https://github.com/saleor/saleor/commit/997f7ea4f576543ec88679a86bfe1b14f7f2ff26 Patch
https://github.com/saleor/saleor/commit/b7cecda8b603f7472790150bb4508c7b655946d4 Patch
https://github.com/saleor/saleor/commit/d8ba545c16ad3153febc5b5be8fd2ef75da9fc95 Patch
https://github.com/saleor/saleor/commit/dccc2c842b4e2e09470929c80f07dc137e439182 Patch
https://github.com/saleor/saleor/commit/ef003c76a304c89ddb2dc65b7f1d5b3b2ba1c640 Patch
https://github.com/saleor/saleor/pull/15694 Issue Tracking
https://github.com/saleor/saleor/pull/15697 Issue Tracking
https://github.com/saleor/saleor/security/advisories/GHSA-mrj3-f2h4-7w45 Vendor Advisory
https://github.com/saleor/saleor/commit/22a1aa3ef0bc54156405f69146788016a7f3f761 Patch
https://github.com/saleor/saleor/commit/39abb0f4e4fe6503f81bfbb871227e4f70bcdd5c Patch
https://github.com/saleor/saleor/commit/47cedfd7d6524d79bdb04708edcdbb235874de6b Patch
https://github.com/saleor/saleor/commit/997f7ea4f576543ec88679a86bfe1b14f7f2ff26 Patch
https://github.com/saleor/saleor/commit/b7cecda8b603f7472790150bb4508c7b655946d4 Patch
https://github.com/saleor/saleor/commit/d8ba545c16ad3153febc5b5be8fd2ef75da9fc95 Patch
https://github.com/saleor/saleor/commit/dccc2c842b4e2e09470929c80f07dc137e439182 Patch
https://github.com/saleor/saleor/commit/ef003c76a304c89ddb2dc65b7f1d5b3b2ba1c640 Patch
https://github.com/saleor/saleor/pull/15694 Issue Tracking
https://github.com/saleor/saleor/pull/15697 Issue Tracking
https://github.com/saleor/saleor/security/advisories/GHSA-mrj3-f2h4-7w45 Vendor Advisory

Track CVE-2024-29888 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-24136Saleor insecure direct object reference vulnerabilitySaleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through 3.22.28 have a n Insecure Direct…EPSS 0.41%8.5CVE-2026-23499Saleor cross-site scripting vulnerabilitySaleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor allowed authenticated staff …EPSS 0.27%7.5CVE-2026-35401Saleor allocation without limits vulnerabilitySaleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a malicious actor can include many GraphQL mutations…EPSS 0.46%7.5CVE-2026-33756Saleor allocation without limits vulnerabilitySaleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query batching by submitting multipl…EPSS 0.79%7.2CVE-2026-22849Saleor cross-site scripting vulnerabilitySaleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify…EPSS 0.24%6.5CVE-2022-0932Saleor missing authorization vulnerabilityMissing Authorization in GitHub repository saleor/saleor prior to 3.1.2.EPSS 1.0%5.9CVE-2026-35407Saleor improper authorization vulnerabilitySaleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and authorization flaw was found i…EPSS 0.41%5.4CVE-2024-31205Saleor cross-site request forgery vulnerabilitySaleor is an e-commerce platform. Starting in version 3.10.0 and prior to versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19, an attac…EPSS 0.19%

Source: NIST National Vulnerability Database (record CVE-2024-29888), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.