CVE-2020-15085 : What You Need to Know

In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local storage mechanism, including credentials. This could allow a malicious user to extract the email and password. The issue was fixed in version 2.10.3.

Understanding CVE-2020-15085

This CVE involves the inadvertent caching of request data containing sensitive information in Saleor Storefront, potentially exposing user credentials.

What is CVE-2020-15085?

In Saleor Storefront versions prior to 2.10.3, user authentication data, including plaintext passwords, was cached in the browser's local storage, posing a security risk.

The Impact of CVE-2020-15085

CVSS Base Score: 6.9 (Medium Severity)
Confidentiality Impact: High
Integrity Impact: Low
Attack Complexity: High
User Interaction: Required
Scope: Changed
The vulnerability could allow a malicious actor with direct access to the browser to extract sensitive login information.

Technical Details of CVE-2020-15085

This section provides more in-depth technical insights into the vulnerability.

Vulnerability Description

The vulnerability involves the caching of sensitive user authentication data, including plaintext passwords, in the browser's local storage.

Affected Systems and Versions

Affected Product: Saleor Storefront
Vendor: Mirumee
Versions Affected: < 2.10.3

Exploitation Mechanism

A malicious user with direct access to the browser could exploit the cached data to extract email and password information.

Mitigation and Prevention

Protecting systems from this vulnerability requires immediate actions and long-term security practices.

Immediate Steps to Take

Upgrade to version 2.10.3 of Saleor Storefront to mitigate the issue.
Manually clear application data (browser's local storage) after logging into Saleor Storefront as a temporary workaround.

Long-Term Security Practices

Implement secure password handling practices.
Regularly update and patch software to prevent similar vulnerabilities.
Educate users on secure login practices and data handling.
Monitor and audit access to sensitive information.

Patching and Updates

Ensure that all systems running Saleor Storefront are updated to version 2.10.3 or newer to address the vulnerability.