CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-40633 – Customer data leak via adjustments API endpoint in Sylius
https://notcve.org/view.php?id=CVE-2024-40633
Sylius is an Open Source eCommerce Framework on Symfony. A security vulnerability was discovered in the `/api/v2/shop/adjustments/{id}` endpoint, which retrieves order adjustments based on incremental integer IDs. The vulnerability allows an attacker to enumerate valid adjustment IDs and retrieve order tokens. Using these tokens, an attacker can access guest customer order details - sensitive guest customer information. The issue is fixed in versions: 1.12.19, 1.13.4 and above. • https://github.com/Sylius/Sylius/security/advisories/GHSA-55rf-8q29-4g43 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-34349 – Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel
https://notcve.org/view.php?id=CVE-2024-34349
Sylius is an open source eCommerce platform. Prior to 1.12.16 and 1.13.1, there is a possibility to execute javascript code in the Admin panel. In order to perform an XSS attack input a script into Name field in which of the resources: Taxons, Products, Product Options or Product Variants. The code will be executed while using an autocomplete field with one of the listed entities in the Admin Panel. Also for the taxons in the category tree on the product form.The issue is fixed in versions: 1.12.16, 1.13.1. • https://github.com/Sylius/Sylius/commit/ba4b66da5af88cdb1bba6174de8bdf42f4853e12 https://github.com/Sylius/Sylius/security/advisories/GHSA-v2f9-rv6w-vw8r • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-24752 – SQL Injection through sorting parameters in SyliusGridBundle
https://notcve.org/view.php?id=CVE-2022-24752
SyliusGridBundle is a package of generic data grids for Symfony applications. Prior to versions 1.10.1 and 1.11-rc2, values added at the end of query sorting were passed directly to the database. The maintainers do not know if this could lead to direct SQL injections but took steps to remediate the vulnerability. The issue is fixed in versions 1.10.1 and 1.11-rc2. As a workaround, overwrite the`Sylius\Component\Grid\Sorting\Sorter.php` class and register it in the container. • https://github.com/Sylius/SyliusGridBundle/commit/73d0791d0575f955e830a3da4c3345f420d2f784 https://github.com/Sylius/SyliusGridBundle/pull/222 https://github.com/Sylius/SyliusGridBundle/releases/tag/v1.10.1 https://github.com/Sylius/SyliusGridBundle/releases/tag/v1.11.0-RC.2 https://github.com/Sylius/SyliusGridBundle/security/advisories/GHSA-2xmm-g482-4439 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2022-24749 – Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius
https://notcve.org/view.php?id=CVE-2022-24749
Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting (XSS) code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the IMG tag. The problem applies both to the files opened on the admin panel and shop pages. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. • https://github.com/Sylius/Sylius/releases/tag/v1.10.11 https://github.com/Sylius/Sylius/releases/tag/v1.11.2 https://github.com/Sylius/Sylius/releases/tag/v1.9.10 https://github.com/Sylius/Sylius/security/advisories/GHSA-4qrp-27r3-66fj • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.2EPSS: 0%CPEs: 2EXPL: 1CVE-2022-24743 – Insufficient Session Expiration in Sylius
https://notcve.org/view.php?id=CVE-2022-24743
Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue is fixed in versions 1.10.11 and 1.11.2. As a workaround, overwrite the `Sylius\Bundle\ApiBundle\CommandHandler\ResetPasswordHandler` class with code provided by the maintainers and register it in a container. • https://github.com/Sylius/Sylius/releases/tag/v1.10.11 https://github.com/Sylius/Sylius/releases/tag/v1.11.2 https://github.com/Sylius/Sylius/security/advisories/GHSA-mf3v-f2qq-pf9g • CWE-613: Insufficient Session Expiration •