Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2019-12186
Good to know:
Date: December 31, 2019
An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the "string" field type. The contents are an object, with malicious code returned by the __toString() method of that object.
Language: PHP
Severity Score
Related Resources (6)
Severity Score
Weakness Type (CWE)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79Top Fix
Upgrade Version
Upgrade to version sylius/grid-bundle - v1.4.5;sylius/grid-bundle - v1.2.18;sylius/grid-bundle - v1.5.1;sylius/grid-bundle - v1.3.13;sylius/grid-bundle - v1.1.19;sylius/sylius - v1.2.17;sylius/sylius - v1.4.1;sylius/sylius - dev-dependabot/composer/rector/rector-tw-1.2.6;sylius/sylius - 1.2.x-dev;sylius/sylius - 1.4.x-dev;sylius/sylius - dev-dependabot/composer/rector/rector-tw-1.2.3;sylius/sylius - dev-dependabot/composer/rector/rector-tw-1.2.5;sylius/sylius - dev-dependabot/composer/rector/rector-tw-1.1.1;sylius/sylius - 1.3.x-dev;sylius/sylius - dev-dependabot/composer/rector/rector-tw-1.2.1;sylius/sylius - 1.1.x-dev;sylius/sylius - dev-dependabot/npm_and_yarn/path-parse-1.0.7;sylius/sylius - v1.1.18;sylius/sylius - dev-CoderMaggie-patch-1;sylius/sylius - dev-dependabot/composer/phpstan/phpstan-doctrine-1.3.4;sylius/sylius - dev-dependabot/composer/rector/rector-tw-1.2.2;sylius/sylius - v1.3.12;sylius/sylius - v1.4.4;sylius/sylius - dev-dependabot/npm_and_yarn/ini-1.3.7;sylius/sylius - dev-dependabot/composer/rector/rector-tw-1.0.5;odiseoteam/sylius - v1.4.4;odiseoteam/sylius - 1.3.x-dev;odiseoteam/sylius - v1.1.18;odiseoteam/sylius - 1.4.x-dev;odiseoteam/sylius - v1.3.12;odiseoteam/sylius - v1.2.17;steffenbrem/sylius - dev-feature/enable-gedmo-3.0;steffenbrem/sylius - dev-master-legacy;steffenbrem/sylius - dev-feature/vagrant-docker;steffenbrem/sylius - dev-bugfix/cascade-transitions-shipment-unit;steffenbrem/sylius - dev-pr/add-required-locales-option-sylius-translations-type;steffenbrem/sylius - dev-bugfix/core-shipping-methods-resolver;sylius/grid - v1.0.0
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | HIGH |
| User Interaction (UI): | REQUIRED |
| Scope (S): | CHANGED |
| Confidentiality (C): | LOW |
| Integrity (I): | LOW |
| Availability (A): | NONE |
CVSS v2
| Base Score: |
|
|---|---|
| Access Vector (AV): | NETWORK |
| Access Complexity (AC): | MEDIUM |
| Authentication (AU): | SINGLE |
| Confidentiality (C): | NONE |
| Integrity (I): | PARTIAL |
| Availability (A): | NONE |
| Additional information: |