| Package | Affected versions | Patched versions |
|---|---|---|
| saleor | = 3.23.0≥ 2.0.0, < 3.20.118≥ 3.21.0, < 3.21.54≥ 3.22.0, < 3.22.47 | 3.20.1183.21.543.22.47 |
Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query batching by submitting multiple GraphQL operations in a single HTTP request as a JSON array but wasn't enforcing any upper limit on the number of operations. This allowed an unauthenticated attacker to send a single HTTP request many operations (bypassing the per query complexity limit) to exhaust resources. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free