title: Saleor is vulnerable to staff-authenticated error message information disclosure vulnerability via Python exceptions
description: Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests.
problem types: CWE-209: Generation of Error Message Containing Sensitive Information
affected:
{
vendor: saleor
product: saleor
versions:
version:  >= 2.0.0, < 3.1.48, status: affected
version: >= 3.11.0, < 3.11.12, status: affected
version: >= 3.10.0, < 3.10.14, status: affected
version: >= 3.9.0, < 3.9.27, status: affected
version: >= 3.8.0, < 3.8.30, status: affected
version: >= 3.7.0, < 3.7.59, status: affected
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]