PT-2023-20452 · Saleor · Saleor

Nyankiyoshi · Published 2023-03-02 · Updated 2023-03-13 · CVE-2023-26052

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Saleor versions prior to 3.1.48 Saleor versions prior to 3.7.59 Saleor versions prior to 3.8.0 Saleor versions prior to 3.9.27 Saleor versions prior to 3.10.14 Saleor versions prior to 3.11.12

Description Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests.

Recommendations For versions prior to 3.1.48, update to version 3.1.48 or later. For versions prior to 3.7.59, update to version 3.7.59 or later. For versions prior to 3.8.0, update to version 3.8.0 or later. For versions prior to 3.9.27, update to version 3.9.27 or later. For versions prior to 3.10.14, update to version 3.10.14 or later. For versions prior to 3.11.12, update to version 3.11.12 or later.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2023-26052

GHSA-3HVJ-3CG9-V242

Affected Products

Saleor

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26052.json · Exploit
• https://github.com/saleor/saleor/security/advisories/GHSA-3hvj-3cg9-v242 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3hvj-3cg9-v242 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26052 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26052 · Security Note
• https://github.com/saleor/saleor/releases/tag/3.1.48 · Note
• https://github.com/saleor/saleor · Note
• https://github.com/saleor/saleor/releases/tag/3.10.14 · Note
• https://github.com/saleor/saleor/releases/tag/3.9.27 · Note
• https://github.com/saleor/saleor/releases/tag/3.11.12 · Note
• https://github.com/saleor/saleor/releases/tag/3.7.59 · Note
• https://github.com/saleor/saleor/releases/tag/3.8.30 · Note
• https://t.me/cibsecurity/59341 · Telegram Post