Lucene search

GoogleOSV:CVE-2023-26052

HistoryMar 02, 2023 - 7:15 p.m.

CVE-2023-26052

2023-03-0219:15:10

Google

osv.dev

saleor

python exceptions

api

error messages

sensitive information

infrastructure details

patched versions

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.002

Percentile

52.5%

JSON

Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests. This issue has been patched in versions 3.1.48, 3.7.59, 3.8.0, 3.9.27, 3.10.14 and 3.11.12.

References

github.com/saleor/saleor/releases/tag/3.1.48

github.com/saleor/saleor/releases/tag/3.10.14

github.com/saleor/saleor/releases/tag/3.11.12

github.com/saleor/saleor/releases/tag/3.7.59

github.com/saleor/saleor/releases/tag/3.8.30

github.com/saleor/saleor/releases/tag/3.9.27

github.com/saleor/saleor/security/advisories/GHSA-3hvj-3cg9-v242

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.002

Percentile

52.5%

JSON

Related for OSV:CVE-2023-26052