CVE-2023-36817 The King's Temple Church website Leaked Stripe API Key in Public Code Repository
A Stripe API key was hardcoded in a public repository, allowing attackers to perform transactions and access customer data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-36817?
CVE-2023-36817 is a high-severity vulnerability in tktchurch website, published on 3 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
`tktchurch/website` contains the codebase for The King's Temple Church website. In version 0.1.0, a Stripe API key was found in the public code repository of the church's project. This sensitive information was unintentionally committed and subsequently exposed in the codebase. If an unauthorized party gains access to this key, they could potentially carry out transactions on behalf of the organization, leading to financial losses. Additionally, they could access sensitive customer information, leading to privacy violations and potential legal implications. The affected component is the codebase of our project, specifically the file(s) where the Stripe API key is embedded. The key should have been stored securely, and not committed to the codebase. The maintainers plan to revoke the leaked Stripe API key immediately, generate a new one, and not commit the key to the codebase.
Which versions are affected by CVE-2023-36817?
It affects 1 product.
Products include Kingstemple the King\'s Temple Church Website.
How do I fix CVE-2023-36817?
No fix has been published for CVE-2023-36817 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-36817 being exploited?
There is no known exploitation of CVE-2023-36817 in the wild and no public exploit code.
Sources
Also known as GHSA-x3m6-5hmf-5x3w.