PT-2023-20451 · Saleor · Saleor

Nyankiyoshi · Publicado 2023-03-02 · Atualizado 2023-03-13 · CVE-2023-26051

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Saleor versions prior to 3.1.48 Saleor versions prior to 3.7.59 Saleor versions prior to 3.8.30 Saleor versions prior to 3.9.27 Saleor versions prior to 3.10.14 Saleor versions prior to 3.11.12

Description The issue arises from internal Python exceptions not being handled properly, resulting in error messages being returned via the API. These messages may contain sensitive information, such as user email addresses, particularly in staff-authenticated requests.

Recommendations For versions prior to 3.1.48, update to version 3.1.48 or later. For versions prior to 3.7.59, update to version 3.7.59 or later. For versions prior to 3.8.30, update to version 3.8.30 or later. For versions prior to 3.9.27, update to version 3.9.27 or later. For versions prior to 3.10.14, update to version 3.10.14 or later. For versions prior to 3.11.12, update to version 3.11.12 or later.

Exploit

Correção

Generation of Error Message Containing Sensitive Information

Enumeração de Fraquezas

CWE-209

Identificadores relacionados

CVE-2023-26051

GHSA-R8QR-WWG3-2R85

Produtos afetados

Saleor

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26051.json · Exploit
• https://github.com/saleor/saleor/commit/31bce881ccccf0d79a9b14ecb6ca3138d1edeec1 · Correção
• https://github.com/saleor/saleor/security/advisories/GHSA-r8qr-wwg3-2r85 · Aviso do Fabricante
• https://github.com/saleor/saleor/releases/tag/3.1.48 · Nota
• https://github.com/saleor/saleor · Nota
• https://github.com/saleor/saleor/releases/tag/3.10.14 · Nota
• https://github.com/saleor/saleor/releases/tag/3.9.27 · Nota
• https://github.com/saleor/saleor/releases/tag/3.11.12 · Nota
• https://github.com/saleor/saleor/releases/tag/3.7.59 · Nota
• https://github.com/saleor/saleor/releases/tag/3.8.30 · Nota
• https://osv.dev/vulnerability/CVE-2023-26051 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-26051 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-r8qr-wwg3-2r85 · Aviso do Fabricante
• https://t.me/cibsecurity/59328 · Publicação no Telegram