CVE-2023-47639mediumCWE-209

CVE-2023-47639: medium-severity vulnerability in api-platform core

API Platform Core can leak exceptions message that may contain sensitive information

Published

Follow this CVE+ Monitor core+ Monitor api-platform/core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.4%
In short

API Platform Core was exposing detailed error messages in JSON responses that could reveal sensitive information about the system. An attacker could trigger errors to learn details about the application's internal workings.

Technical detail

CWE-209 information exposure vulnerability in API Platform Core 3.2.0-3.2.4 where non-HTTP exceptions leak detailed messages in JSON error responses. An unauthenticated attacker can trigger application errors to extract sensitive information about the system's internal state and structure.

Summary generated and translated by AI from the official description.
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. From 3.2.0 until 3.2.4, exception messages, that are not HTTP exceptions, are visible in the JSON error response. This vulnerability is fixed in 3.2.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
api-platform · core
Related CVEs — api-platform core

In the same product, most dangerous first.

CVE-2025-31485HIGHGraphQL grant on a property might be cached with different objectsEPSS 0.6%CVE-2023-25575HIGHSecured properties in API Platform Core may be accessible within collectionsEPSS 0.6%CVE-2025-31481HIGHGraphQL query operations security can be bypassedEPSS 0.5%CVE-2026-54164MEDIUMAPI Platform Core: Missing IRI type check enables resource type confusionEPSS 0.3%CVE-2026-49858MEDIUMAPI Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gateEPSS 0.3%CVE-2025-23204MEDIUMGraphQl securityAfterResolver not calledEPSS 0.3%