{"id":"CVE-2024-31205","summary":"Saleor CSRF bypass in refreshToken mutation","details":"Saleor is an e-commerce platform. Starting in version 3.10.0 and prior to versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19, an attacker may bypass cross-set request forgery (CSRF) validation when calling refresh token mutation with empty string. When a user provides an empty string in `refreshToken` mutation, while the token persists in `JWT_REFRESH_TOKEN_COOKIE_NAME` cookie, application omits validation against CSRF token and returns valid access token. Versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19 contain a patch for the issue. As a workaround, one may replace `saleor.graphql.account.mutations.authentication.refresh_token.py.get_refresh_token`. This will fix the issue, but be aware, that it returns `JWT_MISSING_TOKEN` instead of `JWT_INVALID_TOKEN`.\n","aliases":["GHSA-ff69-fwjf-3c9w"],"modified":"2026-08-12T03:51:30.777170122Z","published":"2024-04-08T14:26:30.971Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-352"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31205.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31205.json"},{"type":"ADVISORY","url":"https://github.com/saleor/saleor/security/advisories/GHSA-ff69-fwjf-3c9w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31205"},{"type":"FIX","url":"https://github.com/saleor/saleor/commit/36699c6f5c99590d24f46e3d5c5b1a3c2fd072e7"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/saleor/saleor","events":[{"introduced":"792acfb0fb764a8074f4e7e3e2c28a32d43f81f9"},{"fixed":"96b115f94965c4cee15c8a5c0dbfbe7cc14a44a8"},{"introduced":"e4dfe7c0dbc7a422375094959a05f80d23598404"},{"fixed":"08e1c8b3f4269b42df3c9c00cc27ec694cfe3061"},{"introduced":"c6ea4207e34902497351d96f983089ebe524e20d"},{"fixed":"fe7e513687a5fe760249642449570762ae5572b1"},{"introduced":"ac075637daf1f6eb77d01aa3d576ee4cbe03008e"},{"fixed":"2c459b93fdd44356f38bc0810e2af9dc5f63d0dd"},{"introduced":"bad64d62e7b350a4fd87a36abcb1586d278edecd"},{"fixed":"9c52aba230c9272e7966aad3c00f8bada11ae007"},{"introduced":"a27de16f3f17668f4f007e79c44cd0c496f40eab"},{"fixed":"9b765f30466df63e2f61db5bec5b1fc31ac90cc4"},{"fixed":"36699c6f5c99590d24f46e3d5c5b1a3c2fd072e7"}],"database_specific":{"cpe":"cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.10.0"},{"fixed":"3.14.64"},{"introduced":"3.15.0"},{"fixed":"3.15.39"},{"introduced":"3.16.0"},{"fixed":"3.16.39"},{"introduced":"3.17.0"},{"fixed":"3.17.35"},{"introduced":"3.18.0"},{"fixed":"3.18.31"},{"introduced":"3.19.0"},{"fixed":"3.19.19"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["3.15.38","3.16.38","3.17.34","3.18.30","3.19.18","3.16.37","3.19.17","3.16.36","3.17.33","3.18.29","3.19.16","3.16.35","3.19.15","3.18.28","3.17.32","3.16.34","3.15.37","3.15.36","3.16.33","3.17.31","3.18.27","3.19.14","3.18.26","3.17.30","3.16.32","3.15.35","3.19.13","3.18.25","3.19.12","3.19.11","3.17.29","3.16.31","3.15.34","3.18.24","3.16.30","3.19.10","3.18.23","3.19.9","3.18.22","3.17.28","3.16.29","3.15.33","3.19.8","3.19.7","3.18.21","3.17.27","3.17.26","3.16.28","3.15.32","3.19.6","3.18.20","3.15.31","3.16.27","3.17.25","3.18.19","3.19.5","3.16.26","3.15.30","3.19.4","3.18.18","3.17.24","3.19.3","3.19.2","3.18.17","3.17.23","3.16.25","3.15.29","3.18.16","3.15.28","3.16.24","3.17.22","3.19.1","3.19.0","3.16.23","3.17.21","3.15.27","3.16.22","3.15.26","3.18.15","3.15.25","3.18.14","3.16.21","3.17.20","3.16.20","3.15.24","3.18.13","3.17.19","3.18.12","3.18.11","3.17.18","3.18.10","3.17.17","3.16.19","3.15.23","3.18.9","3.17.16","3.16.18","3.15.22","3.17.15","3.18.8","3.17.14","3.16.17","3.15.21","3.18.7","3.17.13","3.16.16","3.15.20","3.18.6","3.17.12","3.18.5","3.17.11","3.18.4","3.17.10","3.16.15","3.15.19","3.15.18","3.16.14","3.17.9","3.18.3","3.17.8","3.16.13","3.15.17","3.18.2","3.17.7","3.17.6","3.16.12","3.15.16","3.18.1","3.18.0","3.17.5","3.16.11","3.15.15","3.16.10","3.15.14","3.17.4","3.17.3","3.17.2","3.17.1","3.16.9","3.15.13","3.15.12","3.16.8","3.15.11","3.17.0","3.16.7","3.15.10","3.16.6","3.16.5","3.15.9","3.16.4","3.15.8","3.16.3","3.16.2","3.16.1","3.15.7","3.16.0","3.15.6","3.15.5","3.15.4","3.15.3","3.15.2","3.15.1","3.15.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31205.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}]}