VulnerabilityModified

CVE-2023-26051

Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences.

MEDIUM 4.3EPSS 0.82%

Does this matter?

Lower severity and a low EPSS score (0.82%). Track it; it rarely justifies an emergency change on its own.

Description

Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.82% probability · 55th percentile
CISA KEV: Not listed
Weakness: CWE-209
Affected: saleor/saleor
Source: security-advisories@github.com

References

https://github.com/saleor/saleor/commit/31bce881ccccf0d79a9b14ecb6ca3138d1edeec1Patch
https://github.com/saleor/saleor/releases/tag/3.1.48Release Notes
https://github.com/saleor/saleor/releases/tag/3.10.14Release Notes
https://github.com/saleor/saleor/releases/tag/3.11.12Release Notes
https://github.com/saleor/saleor/releases/tag/3.7.59Release Notes
https://github.com/saleor/saleor/releases/tag/3.8.30Release Notes
https://github.com/saleor/saleor/releases/tag/3.9.27Release Notes
https://github.com/saleor/saleor/security/advisories/GHSA-r8qr-wwg3-2r85Vendor Advisory
https://github.com/saleor/saleor/commit/31bce881ccccf0d79a9b14ecb6ca3138d1edeec1Patch
https://github.com/saleor/saleor/releases/tag/3.1.48Release Notes
https://github.com/saleor/saleor/releases/tag/3.10.14Release Notes
https://github.com/saleor/saleor/releases/tag/3.11.12Release Notes
https://github.com/saleor/saleor/releases/tag/3.7.59Release Notes
https://github.com/saleor/saleor/releases/tag/3.8.30Release Notes
https://github.com/saleor/saleor/releases/tag/3.9.27Release Notes
https://github.com/saleor/saleor/security/advisories/GHSA-r8qr-wwg3-2r85Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.