| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| saleor | ≥ 3.14.56, < 3.14.61≥ 3.15.31, < 3.15.37≥ 3.16.27, < 3.16.34≥ 3.17.25, < 3.17.32≥ 3.18.19, < 3.18.28≥ 3.19.5, < 3.19.15 | 3.14.613.15.373.16.343.17.323.18.283.19.15 |
| saleor | ≥ 3.14.56, < 3.14.61≥ 3.15.31, < 3.15.37≥ 3.16.27, < 3.16.34≥ 3.17.25, < 3.17.32≥ 3.18.19, < 3.18.28≥ 3.19.5, < 3.19.15 | 3.14.613.15.373.16.343.17.323.18.283.19.15 |
Using Pickup: Local stock only as a click-and-collect points could cause a leak of customer addresses
When using Pickup: Local stock only click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes its address as click-and-collect address.
The vulnerability can cause the leak of customer's address when using click-and-collect delivery option marked as Local stock only. It has impact on all orders with click-and-collect delivery method marked as Pickup:Local stock only
The affected versions: >=3.14.56 <3.14.61, >=3.15.31 <3.15.37, >=3.16.27 <3.16.34, >=3.17.25 <3.17.32, >=3.18.19 <3.18.28, >=3.19.5 <3.19.15
This issue has been patched in versions: 3.14.61, 3.15.37, 3.16.34, 3.17.32, 3.18.28, 3.19.15
We strongly recommend upgrading to the latest versions, in case of inability to upgrade straight away, possible workarounds are:
Pickup option is set to Local stock only.Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí