Lucene search

K
cvelistGitHub_MCVELIST:CVE-2023-26052
HistoryMar 02, 2023 - 6:54 p.m.

CVE-2023-26052 Saleor is vulnerable to unauthenticated information disclosure via Python exceptions

2023-03-0218:54:33
CWE-209
GitHub_M
www.cve.org
5
saleor
unauthenticated
information disclosure
python
exceptions
api
error messages
sensitive information
infrastructure details
patched
versions

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.002

Percentile

52.5%

Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests. This issue has been patched in versions 3.1.48, 3.7.59, 3.8.0, 3.9.27, 3.10.14 and 3.11.12.

CNA Affected

[
  {
    "vendor": "saleor",
    "product": "saleor",
    "versions": [
      {
        "version": ">= 2.0.0, < 3.1.48",
        "status": "affected"
      },
      {
        "version": ">= 3.11.0, < 3.11.12",
        "status": "affected"
      },
      {
        "version": ">= 3.10.0, < 3.10.14",
        "status": "affected"
      },
      {
        "version": ">= 3.9.0, < 3.9.27",
        "status": "affected"
      },
      {
        "version": ">= 3.8.0, < 3.8.30",
        "status": "affected"
      },
      {
        "version": ">= 3.7.0, < 3.7.59",
        "status": "affected"
      }
    ]
  }
]

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.002

Percentile

52.5%

Related for CVELIST:CVE-2023-26052