Unauthenticated read and write access to ALL endpoints of a store is possible for removed staff members who had "Apps" permission

业务逻辑 / Client-Side Enforcement of Server-Side Security / #700831

厂商

Shopify

严重程度

低危 · CVSS 4.8

赏金

—

弱点

Client-Side Enforcement of Server-Side Security

研究员

@mariogh

披露日期

2019-10-10

资产

your-store.myshopify.com

CVE

—

该报告还没有中文解读。

Technical Background =====================

(...)
id: "44828"
partnerApps: "[...]"
shopId: "10361503766"
shopifyDomain: "victim-store-mariogh.myshopify.com"
shopifyToken: "████████"
(...)