CVE-2023-47639

API Platform Core can leak exceptions message that may contain sensitive information

State: Published
Severity: 5.3 Medium
Published: Apr 3, 2025
Updated: Apr 3, 2025
Reserved: Nov 7, 2023

Description

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. From 3.2.0 until 3.2.4, exception messages, that are not HTTP exceptions, are visible in the JSON error response. This vulnerability is fixed in 3.2.5.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	GitHub_M

Weaknesses

CWE-209 Generation of Error Message Containing Sensitive Information

Affected Products

Product	Versions
coreapi-platform	>= 3.2.0, < 3.2.5Affected

References

https://github.com/api-platform/core/security/advisories/GHSA-rfw5-cqjj-7v9r
https://github.com/api-platform/core/pull/5823
https://github.com/api-platform/core/commit/ba8a7e6538bccebf14c228e43a9339214c4d9201

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.