CVE-2025-58442

{
  "id": "CVE-2025-58442",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-09T20:15:48.813",
  "lastModified": "2026-10-19T17:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Saleor is an e-commerce platform. Starting in version 3.21.0 and prior to version 3.21.16, requesting certain fields in the response of `accountRegister` may result in errors that could unintentionally reveal whether a user with the provided email already exists in Saleor. Version 3.21.16 fixes the issue. As a workaround, rate-limit the mutation to reduce the impact."
    },
    {
      "lang": "es",
      "value": "Saleor es una plataforma de comercio electrónico. A partir de la versión 3.21.0 y antes de la versión 3.21.16, solicitar ciertos campos en la respuesta de 'accountRegister' puede resultar en errores que podrían revelar involuntariamente si un usuario con el correo electrónico proporcionado ya existe en Saleor. La versión 3.21.16 corrige el problema. Como solución alternativa, limitar la tasa de la mutación para reducir el impacto."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "saleor",
          "product": "saleor",
          "versions": [
            {
              "version": ">= 3.21.0, < 3.21.16",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-10T13:50:34.635633Z",
          "id": "CVE-2025-58442",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-204"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/saleor/saleor/commit/09d671e91ea53a44352d5f685083dc05a2f55e95",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/saleor/saleor/commit/b35783838e51cfc118e07d632f64b01bc3a2c4bb",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/saleor/saleor/releases/tag/3.21.16",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/saleor/saleor/security/advisories/GHSA-8w67-mfm5-fwx5",
      "source": "[email protected]"
    }
  ]
}