CVE-2024-31205

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-31205
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-31205.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-31205
Aliases
  • GHSA-ff69-fwjf-3c9w
Published
2024-04-08T14:26:30Z
Modified
2025-10-20T20:20:54.038945Z
Severity
  • 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Saleor CSRF bypass in refreshToken mutation
Details

Saleor is an e-commerce platform. Starting in version 3.10.0 and prior to versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19, an attacker may bypass cross-set request forgery (CSRF) validation when calling refresh token mutation with empty string. When a user provides an empty string in refreshToken mutation, while the token persists in JWT_REFRESH_TOKEN_COOKIE_NAME cookie, application omits validation against CSRF token and returns valid access token. Versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19 contain a patch for the issue. As a workaround, one may replace saleor.graphql.account.mutations.authentication.refresh_token.py.get_refresh_token. This will fix the issue, but be aware, that it returns JWT_MISSING_TOKEN instead of JWT_INVALID_TOKEN.

Database specific 
{
    "cwe_ids": [
        "CWE-352"
    ]
}
References

Affected packages

Git / github.com/saleor/saleor

Affected ranges

Type
GIT
Repo
https://github.com/saleor/saleor
Events
Introduced
792acfb0fb764a8074f4e7e3e2c28a32d43f81f9
Fixed
96b115f94965c4cee15c8a5c0dbfbe7cc14a44a8
Type
GIT
Repo
https://github.com/saleor/saleor
Events
Introduced
e4dfe7c0dbc7a422375094959a05f80d23598404
Fixed
08e1c8b3f4269b42df3c9c00cc27ec694cfe3061
Type
GIT
Repo
https://github.com/saleor/saleor
Events
Introduced
c6ea4207e34902497351d96f983089ebe524e20d
Fixed
fe7e513687a5fe760249642449570762ae5572b1
Type
GIT
Repo
https://github.com/saleor/saleor
Events
Introduced
ac075637daf1f6eb77d01aa3d576ee4cbe03008e
Fixed
2c459b93fdd44356f38bc0810e2af9dc5f63d0dd
Type
GIT
Repo
https://github.com/saleor/saleor
Events
Introduced
bad64d62e7b350a4fd87a36abcb1586d278edecd
Fixed
9c52aba230c9272e7966aad3c00f8bada11ae007
Type
GIT
Repo
https://github.com/saleor/saleor
Events
Introduced
a27de16f3f17668f4f007e79c44cd0c496f40eab
Fixed
9b765f30466df63e2f61db5bec5b1fc31ac90cc4

Affected versions

3.*

3.15.0
3.15.1
3.15.10
3.15.11
3.15.12
3.15.13
3.15.14
3.15.15
3.15.16
3.15.17
3.15.18
3.15.19
3.15.2
3.15.20
3.15.21
3.15.22
3.15.23
3.15.24
3.15.25
3.15.26
3.15.27
3.15.28
3.15.29
3.15.3
3.15.30
3.15.31
3.15.32
3.15.33
3.15.34
3.15.35
3.15.36
3.15.37
3.15.38
3.15.4
3.15.5
3.15.6
3.15.7
3.15.8
3.15.9
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.18
3.16.19
3.16.2
3.16.20
3.16.21
3.16.22
3.16.23
3.16.24
3.16.25
3.16.26
3.16.27
3.16.28
3.16.29
3.16.3
3.16.30
3.16.31
3.16.32
3.16.33
3.16.34
3.16.35
3.16.36
3.16.37
3.16.38
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.17.0
3.17.1
3.17.10
3.17.11
3.17.12
3.17.13
3.17.14
3.17.15
3.17.16
3.17.17
3.17.18
3.17.19
3.17.2
3.17.20
3.17.21
3.17.22
3.17.23
3.17.24
3.17.25
3.17.26
3.17.27
3.17.28
3.17.29
3.17.3
3.17.30
3.17.31
3.17.32
3.17.33
3.17.34
3.17.4
3.17.5
3.17.6
3.17.7
3.17.8
3.17.9
3.18.0
3.18.1
3.18.10
3.18.11
3.18.12
3.18.13
3.18.14
3.18.15
3.18.16
3.18.17
3.18.18
3.18.19
3.18.2
3.18.20
3.18.21
3.18.22
3.18.23
3.18.24
3.18.25
3.18.26
3.18.27
3.18.28
3.18.29
3.18.3
3.18.30
3.18.4
3.18.5
3.18.6
3.18.7
3.18.8
3.18.9
3.19.0
3.19.1
3.19.10
3.19.11
3.19.12
3.19.13
3.19.14
3.19.15
3.19.16
3.19.17
3.19.18
3.19.2
3.19.3
3.19.4
3.19.5
3.19.6
3.19.7
3.19.8
3.19.9