The GraphQl estimateTotals mutation resolved a cart from its masked ID and calculated totals on it without checking that the cart belonged to the caller. A low-privileged attacker who knows or guesses another customer’s masked cart ID could read that cart’s totals and have the supplied address written to it. The fix verifies cart ownership for the current user and store before any totals are calculated.
This vulnerability affects the following application versions:
- Magento 2.4.7
- Magento 2.4.7-beta3
- Magento 2.4.7-p1
- Magento 2.4.7-p2
- Magento 2.4.7-p3
- Magento 2.4.7-p4
- Magento 2.4.7-p5
- Magento 2.4.7-p6
- Magento 2.4.7-p7
- Magento 2.4.8
- Magento 2.4.8-beta1
- Magento 2.4.8-beta2
- Magento 2.4.8-p1
- Magento 2.4.8-p2
- Magento 2.4.9-alpha1
- Magento 2.4.9-alpha2