Vulnerability · Published Apr 3, 2025 · Assigned by GitHub_M
CVE-2023-47639API Platform Core can leak exceptions message that may contain sensitive information
Medium 5.3
In plain English
A medium-severity security flaw in core from api-platform. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 67.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. From 3.2.0 until 3.2.4, exception messages, that are not HTTP exceptions, are visible in the JSON error response. This vulnerability is fixed in 3.2.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | api-platform/core | 3.2.5 | GHSA-rfw5-cqjj-7v9r |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| api-platform | core | >= 3.2.0, < 3.2.5 |
Weakness: CWE-209 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/api-platform/core/security/advisories/GHSA-rfw5-cqjj-7v9r x_refsource_CONFIRM
- https://github.com/api-platform/core/pull/5823 x_refsource_MISC
- https://github.com/api-platform/core/commit/ba8a7e6538bccebf14c228e43a9339214c4d9201 x_refsource_MISC