CVE-2024-29036

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Saleor Storefront is software for building e-commerce experiences. Prior to commit 579241e75a5eb332ccf26e0bcdd54befa33f4783, when any user authenticates in the storefront, anonymous users are able to access their data. The session is leaked through cache and can be accessed by anyone. Users should upgrade to a version that incorporates commit 579241e75a5eb332ccf26e0bcdd54befa33f4783 or later to receive a patch. A possible workaround is to temporarily disable authentication by changing the usage of `createSaleorAuthClient()`.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Mar 20, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-290379.1datahub-helm provides the Kubernetes Helm charts for deploying Datahub and its dependencies on a Kubernetes cluster. Starting in version 0.1CVE-2024-290383.3tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data wCVE-2024-290398.1tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquCVE-2024-29048.8Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Calliope.This issue affects Calliope: from n/a through 1.0.33.CVE-2024-290404.3This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned bCVE-2024-290416.1Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are CVE-2024-290425.3Translate is a package that allows users to convert text to different languages on Node.js and the browser. Prior to version 3.0.0, an attacCVE-2024-290438.8Microsoft ODBC Driver for SQL Server Remote Code Execution VulnerabilityCVE-2024-290448.8Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityCVE-2024-290457.5Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityCVE-2024-290468.8Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityCVE-2024-290478.8Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVE-2024-29036: Medium severity, CVSS 6.5 | Vulnix