CVE-2023-26051: Saleor is vulnerable to staff-authenticated error message information disclosure vulnerability via Python exceptions
Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-26051?
CVE-2023-26051 has been classified as a moderate severity vulnerability.
How do I fix CVE-2023-26051?
To fix CVE-2023-26051, upgrade Saleor to a version that is not within the affected ranges, such as versions 3.1.48, 3.10.14 or higher.
What information could be exposed due to CVE-2023-26051?
CVE-2023-26051 may expose sensitive internal information, including user email addresses in API error messages.
Which versions of Saleor are affected by CVE-2023-26051?
CVE-2023-26051 affects Saleor versions between 2.0.0 and 3.1.48, 3.2.0 and 3.7.59, 3.8.0 and 3.8.30, 3.9.0 and 3.9.27, 3.10.0 and 3.10.14, and 3.11.0 and 3.11.12.
What should I do if I can't update to a fixed version for CVE-2023-26051?
If you cannot update, you should implement strict logging and error handling practices to mitigate the risk of leaking sensitive information.