« Volver al listado

CVE-2026-33756

Estado: AnalizadaAlta (7.5)—

Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query batching by submitting multiple GraphQL operations in a single HTTP request as a JSON array but wasn't enforcing any upper limit on the number of operations. This allowed an unauthenticated attacker to send a single HTTP request many operations (bypassing the per query complexity limit) to exhaust resources. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Aplicación web expuesta (AV:N, PR:N, UI:N) con batching ilimitado permite DoS por agotamiento de recursos sin autenticación.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Saleor — Saleor

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-33756",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33756",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-08T18:42:19.130571Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "saleor",
          "product": "saleor",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.0.0, < 3.20.118"
            },
            {
              "status": "affected",
              "version": ">= 3.21.0-a.0, < 3.21.54"
            },
            {
              "status": "affected",
              "version": ">= 3.22.0-a.0, < 3.22.47"
            },
            {
              "status": "affected",
              "version": ">= 3.23.0-a.0, < 3.23.0a3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-04-08T18:26:00.700",
  "references": [
    {
      "url": "https://github.com/saleor/saleor/commit/7be352fa8c35875d6e66d36493ca7c14c101bd64",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/saleor/saleor/commit/cdb66da97abb7c86939e384914cd8d9194f378e8",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/saleor/saleor/commit/d6a94e95bd77f3f733fa66afd1b1ac72e863ca2a",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/saleor/saleor/commit/e42aa4d6e588982e78942b033af051c8ec8f43fa",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/saleor/saleor/commit/f0371bdd4cafcc841f1a9e7049cead6133bf7464",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/saleor/saleor/security/advisories/GHSA-24jw-f244-qfpp",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query batching by submitting multiple GraphQL operations in a single HTTP request as a JSON array but wasn't enforcing any upper limit on the number of operations. This allowed an unauthenticated attacker to send a single HTTP request many operations (bypassing the per query complexity limit) to exhaust resources. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118."
    },
    {
      "lang": "es",
      "value": "Saleor es una plataforma de comercio electrónico. Desde la versión 2.0.0 hasta antes de las versiones 3.23.0a3, 3.22.47, 3.21.54 y 3.20.118, Saleor soporta el procesamiento por lotes de consultas al enviar múltiples operaciones GraphQL en una única solicitud HTTP como un array JSON, pero no estaba aplicando ningún límite superior en el número de operaciones. Esto permitía a un atacante no autenticado enviar muchas operaciones en una única solicitud HTTP (eludiendo el límite de complejidad por consulta) para agotar los recursos. Esta vulnerabilidad está corregida en las versiones 3.23.0a3, 3.22.47, 3.21.54 y 3.20.118."
    }
  ],
  "lastModified": "2026-07-24T22:10:00.140",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B4A5EA6-A42E-41BA-9A75-20C9FF65EE98",
              "versionEndExcluding": "3.20.118",
              "versionStartIncluding": "2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2312AF3F-A049-4E4B-AAEF-21D7B5463A3A",
              "versionEndExcluding": "3.21.54",
              "versionStartIncluding": "3.21.0"
            },
            {
              "criteria": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABB6E342-967D-4F4D-9869-BC24C630ACEF",
              "versionEndExcluding": "3.22.47",
              "versionStartIncluding": "3.22.0"
            },
            {
              "criteria": "cpe:2.3:a:saleor:saleor:3.23.0:alpha0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "086CBDFF-B1C4-4AD4-9F39-00B028E29338"
            },
            {
              "criteria": "cpe:2.3:a:saleor:saleor:3.23.0:alpha1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "404B7EE8-9CE0-4B8D-B0B7-2DF60F355E72"
            },
            {
              "criteria": "cpe:2.3:a:saleor:saleor:3.23.0:alpha2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6DD7D745-F558-4CBE-9110-2F7DCBCF4D2F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}