GoogleOSV:GHSA-R8QR-WWG3-2R85Saleor has Staff-Authenticated Error Message Information Disclosure Vulnerability via Python Exceptions
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
42.1%
Impact
Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests.
This issue has been patched in versions 3.1.48, 3.7.59, 3.8.30, 3.9.27, 3.10.14 and 3.11.12.
Workarounds
None
For more information
If you have any questions or comments about this advisory:
- Open a discussion at https://github.com/saleor/saleor/discussions
- Email us at [email protected]
References
github.com/saleor/saleor
github.com/saleor/saleor/commit/31bce881ccccf0d79a9b14ecb6ca3138d1edeec1
github.com/saleor/saleor/releases/tag/3.1.48
github.com/saleor/saleor/releases/tag/3.10.14
github.com/saleor/saleor/releases/tag/3.11.12
github.com/saleor/saleor/releases/tag/3.7.59
github.com/saleor/saleor/releases/tag/3.8.30
github.com/saleor/saleor/releases/tag/3.9.27
github.com/saleor/saleor/security/advisories/GHSA-r8qr-wwg3-2r85
nvd.nist.gov/vuln/detail/CVE-2023-26051
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
42.1%