Lucene search

K
cvelistGitHub_MCVELIST:CVE-2023-26051
HistoryMar 02, 2023 - 6:29 p.m.

CVE-2023-26051 Saleor is vulnerable to staff-authenticated error message information disclosure vulnerability via Python exceptions

2023-03-0218:29:48
CWE-209
GitHub_M
www.cve.org
5
saleor
vulnerability
staff-authenticated
error message
information disclosure
python exceptions
graphql
commerce platform
personalized shopping experiences
sensitive information
user email address
api

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

42.1%

Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests.

CNA Affected

[
  {
    "vendor": "saleor",
    "product": "saleor",
    "versions": [
      {
        "version": " >= 2.0.0, < 3.1.48",
        "status": "affected"
      },
      {
        "version": ">= 3.11.0, < 3.11.12",
        "status": "affected"
      },
      {
        "version": ">= 3.10.0, < 3.10.14",
        "status": "affected"
      },
      {
        "version": ">= 3.9.0, < 3.9.27",
        "status": "affected"
      },
      {
        "version": ">= 3.8.0, < 3.8.30",
        "status": "affected"
      },
      {
        "version": ">= 3.7.0, < 3.7.59",
        "status": "affected"
      }
    ]
  }
]

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

42.1%

Related for CVELIST:CVE-2023-26051