// For flags

CVE-2022-24742

Exposure of Sensitive Information Due to Incompatible Policies in Sylius

Severity Score

5.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect to login page even browser back button is pressed. Another possibility is to set more strict cache policies for restricted content.

Sylius es una plataforma de comercio electrónico de código abierto. En versiones anteriores a 1.9.10, 1.10.11 y 1.11.2, cualquier otro usuario podía visualizar los datos si la pestaña del navegador permanecía sin cerrar después de cerrar la sesión. El problema ha sido solucionado en versiones 1.9.10, 1.10.11 y 1.11.2. Se presenta una medida de mitigación disponible. La aplicación debe redirigir estrictamente a la página de inicio de sesión incluso si es pulsado el botón de retroceso del navegador. Otra posibilidad es establecer políticas de caché más estrictas para el contenido restringido

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-02-10 CVE Reserved
  • 2022-03-14 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-10-18 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-668: Exposure of Resource to Wrong Sphere
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sylius
Search vendor "Sylius"
 Sylius
Search vendor "Sylius" for product "Sylius"
 < 1.9.10
Search vendor "Sylius" for product "Sylius" and version " < 1.9.10"
-
Affected
Sylius
Search vendor "Sylius"
 Sylius
Search vendor "Sylius" for product "Sylius"
 >= 1.10.0 < 1.10.11
Search vendor "Sylius" for product "Sylius" and version " >= 1.10.0 < 1.10.11"
-
Affected
Sylius
Search vendor "Sylius"
 Sylius
Search vendor "Sylius" for product "Sylius"
 >= 1.11.0 < 1.11.2
Search vendor "Sylius" for product "Sylius" and version " >= 1.11.0 < 1.11.2"
-
Affected