Divante Vue Storefront API and Storefront API Stack Trace Disclosure Vulnerability

A vulnerability exists in Divante vue-storefront-api versions through 1.11.1 and in storefront-api versions through 1.0-rc.1. When unexpected HTTP requests are received, the applications respond with an exception that reveals the error stack trace, including absolute file paths and Node.js module names. This issue was merged into the develop branch of both repositories.

Impact

Exploitation of this vulnerability leads to the unintentional disclosure of sensitive information, including file paths and module names, which could aid an attacker in further exploiting the application.