GitHub Advisoryadvisory · npm

GHSA-9wxj-37p8-49ff Diavante vue-storefront-api and storefront-api disclose stack trace

MEDIUM Published 2022-05-24 Modified 2023-07-13 Official page ↗
Aliases
CVE-2020-11883
Ecosystem
npm
Packages
storefront-api, vue-storefront-api
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-209
Reviewed
2023-07-13

Affected packages

• npm storefront-api: < 1.0.0-rc3 → fixed in 1.0.0-rc3 • npm vue-storefront-api: < 1.12.0 → fixed in 1.12.0

Description

In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names.

Related

Alias · CVE (1)

  • CVE-2020-11883 In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References