Skip to main content

Generation of Error Message Containing Sensitive Information

CVE-2023-26052

Medium
5.3/10

Summary

Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests. This issue affects versions prior to 3.1.48, 3.7.x prior to 3.7.59, 3.8.x prior to 3.8.30, 3.9.x prior to 3.9.27, 3.10.x prior to 3.10.14, and 3.11.x prior to 3.11.12. This has the same fix as CVE-2023-26051.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-209 - Generation of Error Message Containing Sensitive Information

The software generates an error message that includes sensitive information about its environment, users, or associated data.

References

Advisory Timeline

  • Published