GitHub Advisoryadvisory · Packagist
GHSA-rc5r-697f-28x6 XSS injection in the Grid component of Sylius
MEDIUM
Official page ↗
- Aliases
- CVE-2019-12186
- Ecosystem
- Packagist
- Packages
- sylius/grid, sylius/grid-bundle, sylius/sylius
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2020-04-15
Affected packages
• Packagist sylius/grid: >= 1.0.0, < 1.1.19 → fixed in 1.1.19
• Packagist sylius/grid: >= 1.2.0, < 1.2.18 → fixed in 1.2.18
• Packagist sylius/grid: >= 1.3.0, < 1.3.13 → fixed in 1.3.13
• Packagist sylius/grid: >= 1.4.0, < 1.4.5 → fixed in 1.4.5
• Packagist sylius/grid: >= 1.5.0, < 1.5.1 → fixed in 1.5.1
• Packagist sylius/grid-bundle: >= 1.0.0, < 1.1.19 → fixed in 1.1.19
• Packagist sylius/grid-bundle: >= 1.2.0, < 1.2.18 → fixed in 1.2.18
• Packagist sylius/grid-bundle: >= 1.3.0, < 1.3.13 → fixed in 1.3.13
• Packagist sylius/grid-bundle: >= 1.4.0, < 1.4.5 → fixed in 1.4.5
• Packagist sylius/grid-bundle: >= 1.5.0, < 1.5.1 → fixed in 1.5.1
• Packagist sylius/sylius: >= 1.0.0, < 1.1.18 → fixed in 1.1.18
• Packagist sylius/sylius: >= 1.2.0, < 1.2.17 → fixed in 1.2.17
• Packagist sylius/sylius: >= 1.3.0, < 1.3.12 → fixed in 1.3.12
• Packagist sylius/sylius: >= 1.4.0, < 1.4.4 → fixed in 1.4.4
Description
Grid component of Sylius omits HTML input sanitisation while rendering object implementing __toString() method through the string field type.
Related
Alias · CVE (1)
- CVE-2019-12186 An issue was discovered in Sylius products. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness