Security readout for executives and security teams
Plain-English summary
Some Saleor Storefront versions saved customer login credentials in browser storage. Anyone with direct access to that browser could potentially read the email and password. This is most concerning on shared, kiosk, or compromised devices. The vendor fixed it in version 2.10.3.
Executive priority
Treat as a moderate confidentiality risk. It is not evidenced as actively exploited, but plaintext password exposure can create customer account and brand risk, especially on shared devices.
Technical view
Saleor Storefront before 2.10.3 cached customer authentication request data in browser local storage, including credentials. The issue maps to CWE-312. Sources state versions before 2.10.0 persisted the cache even after logout. The vendor fixed the behavior in 2.10.3 and named manual clearing of browser application data as a workaround.
Likely exposure
Exposure is limited to organizations running mirumee saleor-storefront versions earlier than 2.10.3. The highest-risk scenarios are shared endpoints, customer service devices, public terminals, or browsers later accessed by another person.
Exploitation context
The source bundle does not show KEV listing or active exploitation. Abuse requires user interaction and direct access to the affected browser storage after a customer login. The provided evidence does not support remote exploitation claims.
Researcher notes
The key condition is client-side local storage retention of authentication request data. Validate only with test accounts and avoid collecting real user passwords. Evidence is clear on affected version range, fixed version, and workaround.
Mitigation direction
- Upgrade Saleor Storefront to version 2.10.3 or later.
- Manually clear browser application data after login where upgrade is not immediate.
- Prioritize shared, kiosk, support, and customer-facing browser environments.
- Review the vendor advisory and changelog before production rollout.
Validation and detection
- Inventory deployed Saleor Storefront versions and identify anything below 2.10.3.
- Using a test account, check whether login credentials persist in browser local storage.
- Confirm logout no longer leaves cached authentication request data behind.
- Verify affected browsers had application data cleared during interim mitigation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-312: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-15085 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N1.64.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.9MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/mirumee/saleor-storefront/security/advisories/GHSA-4279-h39w-2jqmCVE reference · x_refsource_CONFIRM
- https://github.com/mirumee/saleor-storefront/blob/master/CHANGELOG.md#2103CVE reference · x_refsource_MISC
- https://github.com/mirumee/saleor-storefront/commit/7c331e1be805022c9a7be719bd69d050b2577458CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cleartext Storage of Sensitive Information
Cleartext Storage of Sensitive Information represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.