CWE-209

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.0.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "jleehr/canto-saas-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55375"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209",
      "CWE-598"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T14:16:41Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n  In affected versions, the OAuth2 token request sends `app_id`, `app_secret`,\n  `refresh_token` and `code` as URL query parameters of the POST request to\n  `https://oauth.\u003cdomain\u003e/oauth/api/oauth2/token`. Request URLs are commonly\n  recorded in access logs, proxy logs and APM traces, so the application secret\n  and refresh token can be persisted in plain text outside the application\u0027s\n  control.\n\n  In addition, when the token request fails, the Guzzle exception message \u2014\n  which contains the full request URI including the credentials \u2014 was passed\n  unmodified into the `AuthorizationFailedException` thrown by\n  `OAuth2::obtainAccessToken()`. Applications that log exceptions or forward\n  them to error trackers (e.g. Sentry) may therefore have recorded the app\n  secret in their logs.\n\n  ## Impact\n\n  An attacker with access to web server logs, proxy logs, APM tracing data or\n  application error logs of a consumer of this library can obtain the Canto\n  `app_secret`, `refresh_token` or authorization `code` and use them to obtain\n  access tokens for the Canto tenant.\n\n  ## Patches\n\n  Fixed in 3.0.0:\n\n  - OAuth credentials are sent in the form-encoded POST body instead of the URL\n    query string (RFC 6749 \u00a72.3.1). `OAuth2Request::getQueryParams()` now\n    returns `null`; the parameters are available via `getFormParams()`.\n  - Exception messages are sanitized before being rethrown: the values of\n    `app_secret`, `refresh_token` and `code` are masked (including url-encoded,\n    differently cased and JSON-embedded variants).\n\n  ## Workarounds\n\n  If you cannot upgrade:\n\n  - Treat web server, proxy and APM logs of systems performing Canto OAuth\n    requests as secret material and restrict access to them.\n  - Catch `AuthorizationFailedException` in your application and strip the query\n    string from the message before logging or forwarding it.\n\n  If your logs may have been exposed, rotate the affected Canto app secret.",
  "id": "GHSA-37pm-83g7-r22v",
  "modified": "2026-06-19T14:16:41Z",
  "published": "2026-06-19T14:16:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jleehr/canto-saas-api/security/advisories/GHSA-37pm-83g7-r22v"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jleehr/canto-saas-api"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "canto-saas-api: OAuth credentials exposed in URL query string and exception messages"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.grpc:spring-grpc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40969"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-06T20:00:01Z",
    "nvd_published_at": "2026-04-28T15:16:30Z",
    "severity": "LOW"
  },
  "details": "The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker to obtain information about the authentication failure, which may be useful for further attacks.\n\nAffected versions:\nSpring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.",
  "id": "GHSA-37w2-q6vh-45v6",
  "modified": "2026-05-06T20:00:01Z",
  "published": "2026-04-28T15:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40969"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spring-projects/spring-grpc"
    },
    {
      "type": "WEB",
      "url": "https://spring.io/security/cve-2026-40969"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Spring gRPC AuthenticationException messages are reflected to remote client"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/grafana/google-sheets-datasource"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.9.0"
            },
            {
              "fixed": "1.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-4457"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-20T23:27:36Z",
    "nvd_published_at": "2023-10-16T10:15:12Z",
    "severity": "MODERATE"
  },
  "details": "Grafana is an open-source platform for monitoring and observability.\n\nThe Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.2.2 are vulnerable to an information disclosure vulnerability.\n\nThe plugin did not properly sanitize error messages, making it potentially expose the Google Sheet API-key that is configured for the data source.\n\nThis vulnerability was fixed in version 1.2.2.",
  "id": "GHSA-37x5-qpm8-53rq",
  "modified": "2024-05-20T21:57:06Z",
  "published": "2023-10-16T12:33:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4457"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/grafana/google-sheets-datasource"
    },
    {
      "type": "WEB",
      "url": "https://grafana.com/security/security-advisories/cve-2023-4457"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Google Sheets data source plugin for Grafana information disclosure vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-39725"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-25T14:15:21Z",
    "severity": "MODERATE"
  },
  "details": "IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.",
  "id": "GHSA-3835-4hmw-pgj9",
  "modified": "2024-12-25T15:30:42Z",
  "published": "2024-12-25T15:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39725"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7176782"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-38017"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-04T21:15:56Z",
    "severity": "MODERATE"
  },
  "details": "IBM Cloud Pak System\u00a0is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.",
  "id": "GHSA-388r-w9fg-m2x5",
  "modified": "2026-02-04T21:30:32Z",
  "published": "2026-02-04T21:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38017"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7254419"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-52023"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-23T21:15:50Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the PHP backend of gemscms.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed error messages that disclose internal file paths, code snippets, and stack traces. This occurs when specially crafted HTTP GET/POST requests are sent to public API endpoints, exposing potentially sensitive information useful for further exploitation. This issue is classified under CWE-209: Information Exposure Through an Error Message.",
  "id": "GHSA-39jx-3m57-r6qr",
  "modified": "2026-01-26T18:31:29Z",
  "published": "2026-01-23T21:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52023"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/ReverseThatApp/4a6be2b9b2ba39d38c35c8753e0afd39"
    },
    {
      "type": "WEB",
      "url": "http://aptsys.com"
    },
    {
      "type": "WEB",
      "url": "http://gemscms.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.11.0"
            },
            {
              "fixed": "2.9.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.10.0"
            },
            {
              "fixed": "2.10.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.11.0"
            },
            {
              "fixed": "2.11.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-36106"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-06T19:04:54Z",
    "nvd_published_at": "2024-06-06T15:15:45Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nIt\u2019s possible for authenticated users to enumerate clusters by name by inspecting error messages:\n\n```\n$ curl -k \u0027https://localhost:8080/api/v1/clusters/in-cluster?id.type=name\u0027 -H \"Authorization: \nBearer $token\"\n{\"error\":\"permission denied: clusters, get, , sub: alice, iat: 2022-11-04T20:25:44Z\",\"code\":7,\"message\":\"permission denied: clusters, get, , sub: alice, iat: 2022-11-04T20:25:44Z\"}\u23ce                                 \n                                   \n$ curl -k \u0027https://localhost:8080/api/v1/clusters/does-not-exist?id.type=name\u0027 -H \"Authorizati\non: Bearer $token\"\n{\"error\":\"permission denied\",\"code\":7,\"message\":\"permission denied\"}\n```\n\nIt\u2019s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters.\n```\ncurl -k \u0027https://localhost:8080/api/v1/clusters/in-cluster-project?id.type=name\u0027 -H \"Authorization: Bearer $token\"\n{\"error\":\"permission denied: clusters, get, default/, sub: alice, iat: 2022-11-04T20:25:44Z\",\"code\":7,\"message\":\"permission denied: clusters, get, default/, sub: alice, iat: 2022-11-04T20:25:44Z\"}\n\ncurl -k \u0027https://localhost:8080/api/v1/clusters/does-not-exist?id.type=name\u0027 -H \"Authorization: Bearer $token\"\n{\"error\":\"permission denied\",\"code\":7,\"message\":\"permission denied\"}\n```\n\n### Patches\nA patch for this vulnerability has been released in the following Argo CD versions:\n\nv2.11.3\nv2.10.12\nv2.9.17\n\n### For more information\nIf you have any questions or comments about this advisory:\n\nOpen an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\nJoin us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n\nCredits\nThis vulnerability was found \u0026 reported by @crenshaw-dev (Michael Crenshaw)\n\nThe Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue\n",
  "id": "GHSA-3cqf-953p-h5cp",
  "modified": "2024-06-06T19:04:54Z",
  "published": "2024-06-06T19:04:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-3cqf-953p-h5cp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36106"
    },
    {
      "type": "WEB",
      "url": "https://github.com/argoproj/argo-cd/commit/c2647055c261a550e5da075793260f6524e65ad9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/argoproj/argo-cd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Argo-cd authenticated users can enumerate clusters by name"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.7.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/huandu/facebook/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-35232"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-24T20:19:53Z",
    "nvd_published_at": "2024-05-24T21:15:59Z",
    "severity": "LOW"
  },
  "details": "### Summary\naccess_token can be exposed in error message on fail in HTTP request.\n\n### Details\nUsing this module, when HTTP request fails, error message can contain access_token. This can be happen when:\n- module is sending HTTP request with query parameter `?access_token=...`.\n- and HTTP request fails (errors like `facebook: cannot reach facebook server`).\n\nIn such situation, error message is constucted like following.\nhttps://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567\nOriginal error message contained in it comes from `net/http` module. And it can contain full URL, that can contain query parameter `access_token`:\nhttps://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633\nhttps://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30\n\nIt should be very common that applications log error message when they encounter errors. As a result, access_token can be stored into log server and some other infrastructures. Of course other careless error handling in client code that causing other security problems can exist.\n\nI\u0027m not very sure that whether we can consider that github.com/huandu/facebook is vulnerable. Anyway, I think current error message, that can expose access_token, is not desirble.\n\n### PoC\nRequest me this section if you need complete instruction.\n\n### Impact\nClient applications with following conditions can be affected.\n- logs error message from this module\n- or returns error message to client as something like HTTP response.\n- or uses error messages somewhere\n",
  "id": "GHSA-3f65-m234-9mxr",
  "modified": "2024-05-29T20:43:59Z",
  "published": "2024-05-24T20:19:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35232"
    },
    {
      "type": "WEB",
      "url": "https://github.com/huandu/facebook/commit/8b34431b91b32903c8821b1d7621bf81a029d8e4"
    },
    {
      "type": "WEB",
      "url": "https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633"
    },
    {
      "type": "WEB",
      "url": "https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/huandu/facebook"
    },
    {
      "type": "WEB",
      "url": "https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "github.com/huandu/facebook may expose access_token in error message."
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-4483"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-11-06T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 181857.",
  "id": "GHSA-3hg9-f2mv-c9rx",
  "modified": "2022-05-24T17:33:22Z",
  "published": "2022-05-24T17:33:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-4483"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/181857"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/6360835"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "saleor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "3.1.48"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "saleor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.11.0"
            },
            {
              "fixed": "3.11.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "saleor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.10.0"
            },
            {
              "fixed": "3.10.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "saleor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.9.0"
            },
            {
              "fixed": "3.9.27"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "saleor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.8.0"
            },
            {
              "fixed": "3.8.30"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "saleor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.7.0"
            },
            {
              "fixed": "3.7.59"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-26052"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-02T23:04:10Z",
    "nvd_published_at": "2023-03-02T19:15:00Z",
    "severity": "LOW"
  },
  "details": "### Impact\nSome internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests.\n\nAffected versions: Saleor \u2265 2.0.0\n\n### Workarounds\nNone\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a discussion at https://github.com/saleor/saleor/discussions\n* Email us at [hello@saleor.io](mailto:hello@saleor.io)",
  "id": "GHSA-3hvj-3cg9-v242",
  "modified": "2026-07-28T01:21:33Z",
  "published": "2023-03-02T23:04:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/saleor/saleor/security/advisories/GHSA-3hvj-3cg9-v242"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26052"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/saleor/PYSEC-2026-915.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/saleor/saleor"
    },
    {
      "type": "WEB",
      "url": "https://github.com/saleor/saleor/releases/tag/3.1.48"
    },
    {
      "type": "WEB",
      "url": "https://github.com/saleor/saleor/releases/tag/3.10.14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/saleor/saleor/releases/tag/3.11.12"
    },
    {
      "type": "WEB",
      "url": "https://github.com/saleor/saleor/releases/tag/3.7.59"
    },
    {
      "type": "WEB",
      "url": "https://github.com/saleor/saleor/releases/tag/3.8.30"
    },
    {
      "type": "WEB",
      "url": "https://github.com/saleor/saleor/releases/tag/3.9.27"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Saleor Unauthenticated Information Disclosure Vulnerability via Python Exceptions"
}