PT-2023-20452 · Saleor · Saleor

Nyankiyoshi · Publicado 2023-03-02 · Atualizado 2023-03-13 · CVE-2023-26052

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Saleor versions prior to 3.1.48 Saleor versions prior to 3.7.59 Saleor versions prior to 3.8.0 Saleor versions prior to 3.9.27 Saleor versions prior to 3.10.14 Saleor versions prior to 3.11.12

Description Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests.

Recommendations For versions prior to 3.1.48, update to version 3.1.48 or later. For versions prior to 3.7.59, update to version 3.7.59 or later. For versions prior to 3.8.0, update to version 3.8.0 or later. For versions prior to 3.9.27, update to version 3.9.27 or later. For versions prior to 3.10.14, update to version 3.10.14 or later. For versions prior to 3.11.12, update to version 3.11.12 or later.

Exploit

Correção

Generation of Error Message Containing Sensitive Information

Enumeração de Fraquezas

CWE-209

Identificadores relacionados

CVE-2023-26052

GHSA-3HVJ-3CG9-V242

Produtos afetados

Saleor

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26052.json · Exploit
• https://github.com/saleor/saleor/releases/tag/3.1.48 · Nota
• https://github.com/saleor/saleor · Nota
• https://github.com/saleor/saleor/security/advisories/GHSA-3hvj-3cg9-v242 · Aviso do Fabricante
• https://github.com/saleor/saleor/releases/tag/3.10.14 · Nota
• https://github.com/saleor/saleor/releases/tag/3.9.27 · Nota
• https://github.com/saleor/saleor/releases/tag/3.11.12 · Nota
• https://github.com/saleor/saleor/releases/tag/3.7.59 · Nota
• https://github.com/saleor/saleor/releases/tag/3.8.30 · Nota
• https://t.me/cibsecurity/59341 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-3hvj-3cg9-v242 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-26052 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-26052 · Nota de Segurança