CVE-2025-58442

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-58442", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-01T20:03:06.532Z", "datePublished": "2025-09-09T19:46:45.798Z", "dateUpdated": "2025-09-10T13:50:40.777Z"}, "containers": {"cna": {"title": "Saleor has user enumeration vulnerability due to different error messages", "problemTypes": [{"descriptions": [{"cweId": "CWE-204", "lang": "en", "description": "CWE-204: Observable Response Discrepancy", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/saleor/saleor/security/advisories/GHSA-8w67-mfm5-fwx5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/saleor/saleor/security/advisories/GHSA-8w67-mfm5-fwx5"}, {"name": "https://github.com/saleor/saleor/commit/09d671e91ea53a44352d5f685083dc05a2f55e95", "tags": ["x_refsource_MISC"], "url": "https://github.com/saleor/saleor/commit/09d671e91ea53a44352d5f685083dc05a2f55e95"}, {"name": "https://github.com/saleor/saleor/commit/b35783838e51cfc118e07d632f64b01bc3a2c4bb", "tags": ["x_refsource_MISC"], "url": "https://github.com/saleor/saleor/commit/b35783838e51cfc118e07d632f64b01bc3a2c4bb"}, {"name": "https://github.com/saleor/saleor/releases/tag/3.21.16", "tags": ["x_refsource_MISC"], "url": "https://github.com/saleor/saleor/releases/tag/3.21.16"}], "affected": [{"vendor": "saleor", "product": "saleor", "versions": [{"version": ">= 3.21.0, < 3.21.16", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-09T19:46:45.798Z"}, "descriptions": [{"lang": "en", "value": "Saleor is an e-commerce platform. Starting in version 3.21.0 and prior to version 3.21.16, requesting certain fields in the response of `accountRegister` may result in errors that could unintentionally reveal whether a user with the provided email already exists in Saleor. Version 3.21.16 fixes the issue. As a workaround, rate-limit the mutation to reduce the impact."}], "source": {"advisory": "GHSA-8w67-mfm5-fwx5", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-10T13:50:34.635633Z", "id": "CVE-2025-58442", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-10T13:50:40.777Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-58442", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-10T13:50:34.635633Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-10T13:50:38.015Z"}}], "cna": {"title": "Saleor has user enumeration vulnerability due to different error messages", "source": {"advisory": "GHSA-8w67-mfm5-fwx5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "saleor", "product": "saleor", "versions": [{"status": "affected", "version": ">= 3.21.0, < 3.21.16"}]}], "references": [{"url": "https://github.com/saleor/saleor/security/advisories/GHSA-8w67-mfm5-fwx5", "name": "https://github.com/saleor/saleor/security/advisories/GHSA-8w67-mfm5-fwx5", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/saleor/saleor/commit/09d671e91ea53a44352d5f685083dc05a2f55e95", "name": "https://github.com/saleor/saleor/commit/09d671e91ea53a44352d5f685083dc05a2f55e95", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/saleor/saleor/commit/b35783838e51cfc118e07d632f64b01bc3a2c4bb", "name": "https://github.com/saleor/saleor/commit/b35783838e51cfc118e07d632f64b01bc3a2c4bb", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/saleor/saleor/releases/tag/3.21.16", "name": "https://github.com/saleor/saleor/releases/tag/3.21.16", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Saleor is an e-commerce platform. Starting in version 3.21.0 and prior to version 3.21.16, requesting certain fields in the response of `accountRegister` may result in errors that could unintentionally reveal whether a user with the provided email already exists in Saleor. Version 3.21.16 fixes the issue. As a workaround, rate-limit the mutation to reduce the impact."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-204", "description": "CWE-204: Observable Response Discrepancy"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-09T19:46:45.798Z"}}}, "cveMetadata": {"cveId": "CVE-2025-58442", "state": "PUBLISHED", "dateUpdated": "2025-09-10T13:50:40.777Z", "dateReserved": "2025-09-01T20:03:06.532Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-09-09T19:46:45.798Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "saleor", "vendor": "saleor", "versions": [{"status": "affected", "version": ">= 3.21.0, < 3.21.16"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Saleor is an e-commerce platform. Starting in version 3.21.0 and prior to version 3.21.16, requesting certain fields in the response of `accountRegister` may result in errors that could unintentionally reveal whether a user with the provided email already exists in Saleor. Version 3.21.16 fixes the issue. As a workaround, rate-limit the mutation to reduce the impact."}, {"lang": "es", "value": "Saleor es una plataforma de comercio electr\u00f3nico. A partir de la versi\u00f3n 3.21.0 y antes de la versi\u00f3n 3.21.16, solicitar ciertos campos en la respuesta de 'accountRegister' puede resultar en errores que podr\u00edan revelar involuntariamente si un usuario con el correo electr\u00f3nico proporcionado ya existe en Saleor. La versi\u00f3n 3.21.16 corrige el problema. Como soluci\u00f3n alternativa, limitar la tasa de la mutaci\u00f3n para reducir el impacto."}], "id": "CVE-2025-58442", "lastModified": "2026-10-19T17:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58442", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-10T13:50:34.635633Z", "version": "2.0.3"}}]}, "published": "2025-09-09T20:15:48.813", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/saleor/saleor/commit/09d671e91ea53a44352d5f685083dc05a2f55e95"}, {"source": "security-advisories@github.com", "url": "https://github.com/saleor/saleor/commit/b35783838e51cfc118e07d632f64b01bc3a2c4bb"}, {"source": "security-advisories@github.com", "url": "https://github.com/saleor/saleor/releases/tag/3.21.16"}, {"source": "security-advisories@github.com", "url": "https://github.com/saleor/saleor/security/advisories/GHSA-8w67-mfm5-fwx5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-204"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-09-11T10:43:02.690742+00:00", "updated": "2025-09-11T10:43:02.690795+00:00", "vendors": ["saleor", "saleor$PRODUCT$saleor"]}