PT-2020-12917 · Divante · Vue-Storefront-Api+1

Gibkigonzo · Published 2020-04-17 · Updated 2022-05-24 · CVE-2020-11883

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Divante vue-storefront-api versions 1.11.1 and earlier Divante storefront-api versions 1.0-rc.1 and earlier

Description The issue arises from unexpected HTTP requests that lead to an exception, resulting in the disclosure of the error stack trace. This error stack trace includes absolute file paths and Node.js module names.

Recommendations For Divante vue-storefront-api versions 1.11.1 and earlier, consider implementing error handling to prevent the disclosure of sensitive information in the error stack trace. For Divante storefront-api versions 1.0-rc.1 and earlier, restrict access to error messages that may contain absolute file paths and Node.js module names to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-200

CWE-209

Related Identifiers

CVE-2020-11883

GHSA-9WXJ-37P8-49FF

Affected Products

Storefront-Api

Vue-Storefront-Api

References · 7

• 🔥 https://github.com/DivanteLtd/vue-storefront-api/pull/431 · Exploit
• https://github.com/DivanteLtd/storefront-api/pull/59 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-11883 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11883 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9wxj-37p8-49ff · Vendor Advisory
• https://github.com/vuestorefront/vue-storefront-api/commit/965247f41f872e84e4662d04d8e2108eaf6119da · Note
• https://github.com/vuestorefront/storefront-api/commit/9165b80c72b469c9615ce2f665499e6f6ead0a6a · Note