CVE-2023-26052: Saleor is vulnerable to unauthenticated information disclosure via Python exceptions
Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests. This issue has been patched in versions 3.1.48, 3.7.59, 3.8.0, 3.9.27, 3.10.14 and 3.11.12.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-26052?
CVE-2023-26052 has a moderate severity rating due to the exposure of sensitive internal error messages in API responses.
How do I fix CVE-2023-26052?
To mitigate CVE-2023-26052, update Saleor to a version beyond 3.1.48, 3.7.59, 3.8.30, 3.9.27, 3.10.14, or 3.11.12.
Which versions of Saleor are affected by CVE-2023-26052?
CVE-2023-26052 affects Saleor versions from 2.0.0 to 3.1.48, from 3.2.0 to 3.7.59, from 3.8.0 to 3.8.30, from 3.9.0 to 3.9.27, from 3.10.0 to 3.10.14, and from 3.11.0 to 3.11.12.
What type of data can be leaked due to CVE-2023-26052?
CVE-2023-26052 may expose sensitive information including infrastructure details through improperly handled internal Python exceptions.
Is CVE-2023-26052 only a concern for API users?
Yes, CVE-2023-26052 primarily impacts users of the Saleor API who may receive sensitive error messages.