Vulnerability · Published Apr 17, 2020 · Assigned by mitre
CVE-2020-11883
Medium 5.3
In plain English
A medium-severity security flaw in the storefront-api package (npm). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 15.2% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)15.2%top 3.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | storefront-api | 1.0.0-rc3 | GHSA-9wxj-37p8-49ff |
| npm | vue-storefront-api | 1.12.0 | GHSA-9wxj-37p8-49ff |
Affected products (as reported)
References
- https://github.com/DivanteLtd/vue-storefront-api/pull/431 x_refsource_MISC
- https://github.com/DivanteLtd/storefront-api/pull/59 x_refsource_MISC