Vulnerability · Published May 10, 2024 · Assigned by GitHub_M
CVE-2024-34349Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel
Medium 4.8
In plain English
A medium-severity cross-site scripting in Sylius from Sylius. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Sylius is an open source eCommerce platform. Prior to 1.12.16 and 1.13.1, there is a possibility to execute javascript code in the Admin panel. In order to perform an XSS attack input a script into Name field in which of the resources: Taxons, Products, Product Options or Product Variants. The code will be executed while using an autocomplete field with one of the listed entities in the Admin Panel. Also for the taxons in the category tree on the product form.The issue is fixed in versions: 1.12.16, 1.13.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | sylius/sylius | 1.9.12 | GHSA-v2f9-rv6w-vw8r |
| Packagist | sylius/sylius | 1.10.16 | GHSA-v2f9-rv6w-vw8r |
| Packagist | sylius/sylius | 1.11.17 | GHSA-v2f9-rv6w-vw8r |
| Packagist | sylius/sylius | 1.12.16 | GHSA-v2f9-rv6w-vw8r |
| Packagist | sylius/sylius | 1.13.1 | GHSA-v2f9-rv6w-vw8r |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N