CVE-2020-7964

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer).

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Jan 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-79658.8flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the CVE-2020-79667.5GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal.CVE-2020-79674.3GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2).CVE-2020-79687.5GitLab EE 8.0 through 12.7.2 has Incorrect Access Control.CVE-2020-79697.5GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure.CVE-2020-79716.1GitLab EE 11.0 and later through 12.7.2 allows XSS.CVE-2020-79727.5GitLab EE 12.2 has Insecure Permissions (issue 2 of 2).CVE-2020-79736.1GitLab through 12.7.2 allows XSS.CVE-2020-79745.3GitLab EE 10.1 through 12.7.2 allows Information Disclosure.CVE-2020-79765.3GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control.CVE-2020-79775.3GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions.CVE-2020-79787.5GitLab EE 12.6 and later through 12.7.2 allows Denial of Service.