Security patches | April 8, 2024

[zedzior]

Hi Community!

We will be releasing patch versions to Saleor fixing a security defect rated as "moderate" for the following versions: 3.14, 3.15, 3.16, 3.17, 3.18, 3.19.

📅 When? At 12:00 UTC Monday, April 8, 2024.

We will provide more details in this thread once the fix is published, including the patched versions list.

[zedzior]

Hey Community!

We've just released security fixes for Saleor 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31 and 3.19.19.

A CSRF bypass vulnerability was present in the refresh token mutation.

CVE-2024-31205: Cross-Site Request Forgery (CSRF)

Severity: moderate.

Details: GHSA-ff69-fwjf-3c9w