CVE-2023-32694
Published: May 25, 2023
Modified: Jan 16, 2025
CVSS v3.1
4.8
Description
Saleor Core is a composable, headless commerce API. Saleor's `validate_hmac_signature` function is vulnerable to timing attacks. Malicious users could abuse this vulnerability on Saleor deployments having the Adyen plugin enabled in order to determine the secret key and forge fake events, this could affect the database integrity such as marking an order as paid when it is not. This issue has been patched in versions 3.7.68, 3.8.40, 3.9.49, 3.10.36, 3.11.35, 3.12.25, and 3.13.16.
| Vendor | Product | Versions |
|---|---|---|
saleor | saleor | affected >= 2.11.0, < 3.7.68affected >= 3.8.0, < 3.8.40affected >= 3.9.0, < 3.9.49affected >= 3.10.0, < 3.10.36affected >= 3.11.0, < 3.11.35+2 more versions |
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now