<p>A fix was pushed into the <code>master</code> branch but not yet published.</p>

Information Exposure Affecting saleor package, versions [0,]

Snyk CVSS

Attack Complexity High

Threat Intelligence

EPSS 0.06% (27^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-PYTHON-SALEOR-5603194
published 26 May 2023
disclosed 26 May 2023
credit Unknown

Report a new vulnerability Found a mistake?

Introduced: 26 May 2023

CVE-2023-32694 Open this link in a new tab CWE-203 Open this link in a new tab

How to fix?

A fix was pushed into the master branch but not yet published.

Overview

Affected versions of this package are vulnerable to Information Exposure due to the validate_hmac_signature function being vulnerable to timing attacks. Malicious users could abuse this vulnerability on Saleor deployments having the Adyen plugin enabled in order to determine the secret key and forge fake events. This could affect the database integrity such as marking an order as paid when it is not.