CVE-2023-26052: Saleor information disclosure via unhandled Python exceptions

CVE-2023-26052 · Severity: low · CVSS 3.7 · Published 2023-03-02

Saleor, a headless GraphQL e-commerce platform, is affected by a vulnerability where internal system errors are not properly handled. This can cause the platform to reveal sensitive technical details about its underlying infrastructure to any user on the internet, even without logging in. While this does not directly allow an attacker to modify data, the leaked information could be used to plan more sophisticated attacks against the company's servers.

Technologies: saleor (PyPI), Saleor. Vendors: PyPI, Saleor.

Quick answers

Is CVE-2023-26052 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-26052 being exploited in the wild.
How severe is CVE-2023-26052?
Low severity, with a CVSS score of 3.7, published 2 March 2023.
Which products and versions are affected?
saleor (PyPI) ECOSYSTEM:introduced=2.0.0,fixed=3.1.48, ECOSYSTEM:introduced=2.0.0,fixed=3.1.48,introduced=3.7.0,fixed=3.7.59,introduced=3.8.0,fixed=3.8.30,introduced=3.9.0,fixed=3.9.27,introduced=3.10.0,fixed=3.10.14,introduced=3.11.0,fixed=3.11.12; Saleor >= 2.0.0, < 3.1.48; >= 3.7.0, < 3.7.59; >= 3.8.0, < 3.8.30; >= 3.9.0, < 3.9.27; >= 3.10.0, < 3.10.14; >= 3.11.0, < 3.11.12.
Is there a fix for CVE-2023-26052?
Yes. saleor (PyPI): upgrade to 3.1.48, 3.11.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-26052 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2023-26052?
Check whether you run saleor (PyPI) or Saleor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • saleor (PyPI): upgrade to 3.1.48, 3.11.12 or later
    pip install "saleor>=3.11.12"

Technical details

Saleor (versions 2.0.0 and later) fails to properly sanitize internal Python exceptions before returning them as GraphQL API error messages. This vulnerability, classified as CWE-209, allows an unauthenticated remote attacker to trigger specific application states that result in unhandled exceptions. The resulting error responses may disclose sensitive environment or infrastructure details. The attack complexity is rated as high because it typically requires specific conditions to trigger the informative exceptions. Patches have been released across multiple major versions including 3.1.48, 3.7.59, 3.8.30, 3.9.27, 3.10.14, and 3.11.12.

Affected products

  • Saleor Saleor >= 2.0.0, < 3.1.48; >= 3.7.0, < 3.7.59; >= 3.8.0, < 3.8.30; >= 3.9.0, < 3.9.27; >= 3.10.0, < 3.10.14; >= 3.11.0, < 3.11.12

Identifiers

  • CVE-2023-26052
  • GHSA-3hvj-3cg9-v242
  • PYSEC-2026-915

Timeline

  • 2023-03-02: advisory
  • 2023-03-02: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.