LiveActive security incident?Get immediate response
CVE Record

CVE-2023-36817: The King's Temple Church website Leaked Stripe API Key in Public Code Repository

`tktchurch/website` contains the codebase for The King's Temple Church website. In version 0.1.0, a Stripe API key was found in the public code repository of the church's project. This sensitive information was unintentionally committed and subsequently exposed in the codebase. If an unauthorized party gains access to this key, they could potentially carry out transactions on behalf of the organization, leading to financial losses. Additionally, they could access sensitive customer information, leading to privacy violations and potential legal implications. The affected component is the codebase of our project, specifically the file(s) where the Stripe API key is embedded. The key should have been stored securely, and not committed to the codebase. The maintainers plan to revoke the leaked Stripe API key immediately, generate a new one, and not commit the key to the codebase.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Stripe API key for The King's Temple Church website was committed into a public code repository. Anyone who obtained the key could potentially act against the organization’s Stripe account, creating financial and privacy risk. The provided sources say maintainers planned to revoke and replace the key.

Executive priority

Treat this as a high-priority credential incident, not a typical software bug. The most important actions are revocation, rotation, and account review. Business urgency depends on whether the leaked key was live and what permissions it had.

Technical view

CVE-2023-36817 is a hard-coded credential exposure in tktchurch/website version 0.1.0. The issue maps to CWE-798 and CWE-200. CVSS 3.1 is 7.5, driven by unauthenticated network access and high confidentiality impact. The source bundle does not identify the exact file or confirm misuse.

Likely exposure

Exposure appears narrow: tktchurch/website version 0.1.0 and any public repository history or deployment that retained the leaked Stripe API key. The bundle does not show broader product impact, CPEs, or affected third-party packages.

Exploitation context

The CVE is not listed as KEV in the provided bundle, and no cited source confirms active exploitation. Risk comes from public credential exposure: a copied Stripe key may remain usable until revoked, even if later removed from visible code.

Researcher notes

Evidence supports hard-coded secret disclosure, but is incomplete on the specific file, key permissions, exposure duration, and whether remediation was completed. Do not assume exploitation. Focus validation on repository history, deployed configuration, Stripe key status, and account activity.

Mitigation direction

  • Revoke the exposed Stripe API key immediately.
  • Generate and deploy a replacement Stripe key.
  • Store the new key outside source code, using a secrets manager or environment variable.
  • Remove the key from current code and check public repository history.
  • Review vendor and Stripe guidance for any additional response steps.

Validation and detection

  • Confirm whether tktchurch/website version 0.1.0 is present or reused.
  • Inspect the public repository and history for embedded Stripe keys.
  • Verify the exposed key has been revoked in Stripe.
  • Confirm deployments use the replacement secret from secure configuration.
  • Review Stripe account activity for suspicious access or transactions.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-200: Information exposure and cloud metadata lookup

Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · medium confidence lookup

CWE-798: Credential and account abuse lookup

Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2023-36817 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2023-36817Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
tktchurchwebsite= 0.1.0Listed
Weakness

CWE details

CWE-200CWE-798

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.