Information Exposure Affecting saleor package, versions [0,]
Threat Intelligence
EPSS
0.07% (31st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-SALEOR-5603194
- published 26 May 2023
- disclosed 26 May 2023
- credit Unknown
Introduced: 26 May 2023
CVE-2023-32694 Open this link in a new tabHow to fix?
A fix was pushed into the master branch but not yet published.
Overview
Affected versions of this package are vulnerable to Information Exposure due to the validate_hmac_signature function being vulnerable to timing attacks. Malicious users could abuse this vulnerability on Saleor deployments having the Adyen plugin enabled in order to determine the secret key and forge fake events. This could affect the database integrity such as marking an order as paid when it is not.
References
CVSS Scores
version 3.1