PT-2022-16838 · Sylius · Sylius

Lchrusciel · Published 2022-03-14 · Updated 2022-03-22 · CVE-2022-24733

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 1.9.10 Sylius versions prior to 1.10.11 Sylius versions prior to 1.11.2

Description The issue allows a page controlled by an attacker to load the website within an iframe, enabling a clickjacking attack. This attack overlays the target application's interface with a different interface provided by the attacker.

Recommendations For versions prior to 1.9.10, update to version 1.9.10 or later. For versions prior to 1.10.11, update to version 1.10.11 or later. For versions prior to 1.11.2, update to version 1.11.2 or later. As a temporary workaround, consider setting the X-Frame-Options header to sameorigin for every response from the app by adding a new subscriber.

Exploit

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2022-24733

GHSA-4JP3-Q2QM-9FMW

Affected Products

Sylius

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24733.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-24733 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24733 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4jp3-q2qm-9fmw · Vendor Advisory
• https://github.com/Sylius/Sylius · Note
• https://github.com/Sylius/Sylius/releases/tag/v1.9.10 · Note
• https://github.com/Sylius/Sylius/releases/tag/v1.10.11 · Note
• https://github.com/Sylius/Sylius/security/advisories/GHSA-4jp3-q2qm-9fmw · Note
• https://github.com/Sylius/Sylius/releases/tag/v1.11.2 · Note
• https://t.me/cibsecurity/38901 · Telegram Post