CVE-2023-26051: Saleor information disclosure via Python exceptions in API error messages

CVE-2023-26051 · Severity: medium · CVSS 6.5 · Published 2023-03-03

Saleor is an e-commerce platform used to manage online stores and shopping experiences. A security flaw in how the system handles errors allows staff members to see sensitive internal information, such as user email addresses, that should normally be hidden. This could lead to the exposure of customer data to unauthorized staff or anyone who gains access to a staff account.

Technologies: saleor (PyPI), Saleor. Vendors: PyPI, Saleor.

Quick answers

Is CVE-2023-26051 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-26051 being exploited in the wild.
How severe is CVE-2023-26051?
Medium severity, with a CVSS score of 6.5, published 3 March 2023.
Which products and versions are affected?
saleor (PyPI) ECOSYSTEM:introduced=2.0.0,fixed=3.1.48, ECOSYSTEM:introduced=2.0.0,fixed=3.1.48,introduced=3.7.0,fixed=3.7.59,introduced=3.8.0,fixed=3.8.30,introduced=3.9.0,fixed=3.9.27,introduced=3.10.0,fixed=3.10.14,introduced=3.11.0,fixed=3.11.12; Saleor >= 2.0.0, < 3.1.48; >= 3.7.0, < 3.7.59; >= 3.8.0, < 3.8.30; >= 3.9.0, < 3.9.27; >= 3.10.0, < 3.10.14; >= 3.11.0, < 3.11.12.
Is there a fix for CVE-2023-26051?
Yes. saleor (PyPI): upgrade to 3.1.48, 3.11.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-26051 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2023-26051?
Check whether you run saleor (PyPI) or Saleor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • saleor (PyPI): upgrade to 3.1.48, 3.11.12 or later
    pip install "saleor>=3.11.12"

Technical details

The vulnerability is a sensitive information disclosure (CWE-209) within the Saleor GraphQL API. It occurs because certain internal Python exceptions are not properly caught or sanitized before being returned to the client. An attacker with staff-level authentication can trigger these exceptions through specific API requests to view sensitive data, such as user email addresses, contained within the error messages. The fix involves implementing a blocklist/allowlist for exception messages to ensure internal system details are not leaked. Patches are available in versions 3.1.48, 3.7.59, 3.8.30, 3.9.27, 3.10.14, and 3.11.12.

Affected products

  • Saleor Saleor >= 2.0.0, < 3.1.48; >= 3.7.0, < 3.7.59; >= 3.8.0, < 3.8.30; >= 3.9.0, < 3.9.27; >= 3.10.0, < 3.10.14; >= 3.11.0, < 3.11.12

Identifiers

  • CVE-2023-26051
  • GHSA-r8qr-wwg3-2r85
  • PYSEC-2026-917

Timeline

  • 2023-03-02: patched: Fix committed to repository
  • 2023-03-02: disclosed: NVD publication date
  • 2023-03-03: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.