CVE-2023-32694 - CVE House

Back to Database

Status published Medium CVE-2023-32694

Non-constant time HMAC comparison in Adyen plugin in Saleor

4.8 CVSS

Vulnerability Description

Saleor Core is a composable, headless commerce API. Saleor's `validate_hmac_signature` function is vulnerable to timing attacks. Malicious users could abuse this vulnerability on Saleor deployments having the Adyen plugin enabled in order to determine the secret key and forge fake events, this could affect the database integrity such as marking an order as paid when it is not. This issue has been patched in versions 3.7.68, 3.8.40, 3.9.49, 3.10.36, 3.11.35, 3.12.25, and 3.13.16.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-32694

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from saleor

View All →

Saleor has user enumeration vulnerability due to different error messages

Saleor CSRF bypass in refreshToken mutation

Saleor vulnerable to customers addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method

Saleor Storefront session leak in cache

Cross-site Scripting (XSS) - DOM in saleor/react-storefront

Affected Vendor

saleor

View all reports →

Affected Software

saleor

Vulnerable Versions:

>= 2.11.0, < 3.7.68, >= 3.8.0, < 3.8.40, >= 3.9.0, < 3.9.49, >= 3.10.0, < 3.10.36, >= 3.11.0, < 3.11.35, >= 3.12.0, < 3.12.25, >= 3.13.0, < 3.13.16

Timeline

Official Publish: May 25th, 2023

Last Modified: January 16th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-203 CWE-208

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1213 Data from Information Repositories

T1046 Network Service Discovery