PT-2023-20451 · Saleor · Saleor

Nyankiyoshi · Published 2023-03-02 · Updated 2023-03-13 · CVE-2023-26051

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Saleor versions prior to 3.1.48 Saleor versions prior to 3.7.59 Saleor versions prior to 3.8.30 Saleor versions prior to 3.9.27 Saleor versions prior to 3.10.14 Saleor versions prior to 3.11.12

Description The issue arises from internal Python exceptions not being handled properly, resulting in error messages being returned via the API. These messages may contain sensitive information, such as user email addresses, particularly in staff-authenticated requests.

Recommendations For versions prior to 3.1.48, update to version 3.1.48 or later. For versions prior to 3.7.59, update to version 3.7.59 or later. For versions prior to 3.8.30, update to version 3.8.30 or later. For versions prior to 3.9.27, update to version 3.9.27 or later. For versions prior to 3.10.14, update to version 3.10.14 or later. For versions prior to 3.11.12, update to version 3.11.12 or later.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2023-26051

GHSA-R8QR-WWG3-2R85

Affected Products

Saleor

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26051.json · Exploit
• https://github.com/saleor/saleor/commit/31bce881ccccf0d79a9b14ecb6ca3138d1edeec1 · Patch
• https://github.com/saleor/saleor/security/advisories/GHSA-r8qr-wwg3-2r85 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26051 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26051 · Security Note
• https://osv.dev/vulnerability/GHSA-r8qr-wwg3-2r85 · Vendor Advisory
• https://github.com/saleor/saleor/releases/tag/3.1.48 · Note
• https://github.com/saleor/saleor · Note
• https://github.com/saleor/saleor/releases/tag/3.10.14 · Note
• https://github.com/saleor/saleor/releases/tag/3.9.27 · Note
• https://github.com/saleor/saleor/releases/tag/3.11.12 · Note
• https://github.com/saleor/saleor/releases/tag/3.7.59 · Note
• https://github.com/saleor/saleor/releases/tag/3.8.30 · Note
• https://t.me/cibsecurity/59328 · Telegram Post