PT-2019-14824 · Sylius · Sylius

Pamil · Published 2019-12-05 · Updated 2019-12-17 · CVE-2019-16768

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 1.3.14 Sylius versions prior to 1.4.10 Sylius versions prior to 1.5.7 Sylius versions prior to 1.6.3

Description In affected versions of Sylius, exception messages from internal exceptions, such as database exceptions, are wrapped by SymfonyComponentSecurityCoreExceptionAuthenticationServiceException and propagated through the system to the UI. This may cause some internal system information to leak and be visible to the customer. A validation message with the exception details will be presented to the user when they try to log into the shop.

Recommendations For Sylius versions prior to 1.3.14, update to version 1.3.14 or later. For Sylius versions prior to 1.4.10, update to version 1.4.10 or later. For Sylius versions prior to 1.5.7, update to version 1.5.7 or later. For Sylius versions prior to 1.6.3, update to version 1.6.3 or later. As a temporary workaround, override the src/Sylius/Bundle/UiBundle/Resources/views/Security/ login.html.twig file and replace lines with the provided code to prevent exception details from being displayed to the user.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2019-16768

GHSA-3R8J-PMCH-5J2H

Affected Products

Sylius

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-16768 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16768 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3r8j-pmch-5j2h · Vendor Advisory
• https://github.com/Sylius/Sylius/commit/be245302dfc594d8690fe50dd47631d186aa945f · Note
• https://github.com/Sylius/Sylius/security/advisories/GHSA-3r8j-pmch-5j2h · Note
• https://github.com/advisories/GHSA-3r8j-pmch-5j2h · Note