CVE-2020-11883

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 15.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-04-17 · updated 2026-06-17
Weakness: CWE-209

Description

In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names.

Affected products

Divante Storefront-Api: 1.0-rc1
Divante Vue-Storefront-Api: through 1.11.1

References

https://github.com/DivanteLtd/storefront-api/pull/59
https://github.com/DivanteLtd/vue-storefront-api/pull/431
https://github.com/DivanteLtd/storefront-api/pull/59
https://github.com/DivanteLtd/vue-storefront-api/pull/431

Get alerted when CVE-2020-11883 or the next vulnerability affects your stack