PT-2019-12687 · Sylius · Sylius+1

Published 2019-12-31 · Updated 2020-04-15 · CVE-2019-12186

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions sylius/sylius versions 1.0.x through 1.0.18 sylius/sylius versions 1.1.x through 1.1.17 sylius/sylius versions 1.2.x through 1.2.16 sylius/sylius versions 1.3.x through 1.3.11 sylius/sylius versions 1.4.x through 1.4.3 sylius/grid versions 1.0.x through 1.0.18 sylius/grid versions 1.1.x through 1.1.18 sylius/grid versions 1.2.x through 1.2.17 sylius/grid versions 1.3.x through 1.3.12 sylius/grid versions 1.4.x through 1.4.4 sylius/grid version 1.5.0

Description The issue is related to missing input sanitization, allowing an attacker to perform XSS by injecting malicious code into a field displayed in a grid with the "string" field type. This occurs when the contents are an object, with malicious code returned by the toString() method of that object. The grid component omits HTML input sanitization while rendering an object implementing the toString() method through the string field type.

Recommendations For sylius/sylius versions 1.0.x through 1.0.18, update to a version outside of this range to mitigate the risk. For sylius/sylius versions 1.1.x through 1.1.17, update to a version outside of this range to mitigate the risk. For sylius/sylius versions 1.2.x through 1.2.16, update to a version outside of this range to mitigate the risk. For sylius/sylius versions 1.3.x through 1.3.11, update to a version outside of this range to mitigate the risk. For sylius/sylius versions 1.4.x through 1.4.3, update to a version outside of this range to mitigate the risk. For sylius/grid versions 1.0.x through 1.0.18, update to a version outside of this range to mitigate the risk. For sylius/grid versions 1.1.x through 1.1.18, update to a version outside of this range to mitigate the risk. For sylius/grid versions 1.2.x through 1.2.17, update to a version outside of this range to mitigate the risk. For sylius/grid versions 1.3.x through 1.3.12, update to a version outside of this range to mitigate the risk. For sylius/grid versions 1.4.x through 1.4.4, update to a version outside of this range to mitigate the risk. For sylius/grid version 1.5.0, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider disabling the toString() method in objects displayed in grids with the "string" field type until a patch is available. Restrict access to the grid component to minimize the risk of exploitation. Avoid using the string field type in grids until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-12186

GHSA-RC5R-697F-28X6

Affected Products

Sylius

Sylius Grid

References · 6

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/grid/CVE-2019-12186.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/sylius/CVE-2019-12186.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12186 · Security Note
• https://osv.dev/vulnerability/GHSA-rc5r-697f-28x6 · Vendor Advisory
• https://sylius.com/blog/cve-2019-12186 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12186 · Vendor Advisory