PT-2022-16845 · Sylius · Sylius

Lchrusciel · Published 2022-03-14 · Updated 2023-06-30 · CVE-2022-24742

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 1.9.10, 1.10.11, and 1.11.2

Description The issue allows any other user to view the data if the browser tab remains open after logging out. This can lead to a data leak, such as customer details or payment gateway configuration, if these pages were previously accessed by the administrator. The vulnerability requires full access to the computer to take advantage of it.

Recommendations For versions prior to 1.9.10, 1.10.11, and 1.11.2, update to version 1.9.10, 1.10.11, or 1.11.2 to fix the issue. As a temporary workaround, consider implementing a strict redirect to the login page even when the browser back button is pressed. Another possibility is to set more strict cache policies for restricted content, such as 'no-store', by using a custom CacheControlSubscriber class.

Exploit

Fix

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-200

CWE-213

CWE-668

Related Identifiers

CVE-2022-24742

GHSA-7563-75J9-6H5P

Affected Products

Sylius

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24742.json · Exploit
• https://osv.dev/vulnerability/GHSA-7563-75j9-6h5p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24742 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24742 · Vendor Advisory
• https://github.com/Sylius/Sylius · Note
• https://github.com/Sylius/Sylius/releases/tag/v1.9.10 · Note
• https://github.com/Sylius/Sylius/security/advisories/GHSA-7563-75j9-6h5p · Note
• https://github.com/Sylius/Sylius/releases/tag/v1.10.11 · Note
• https://github.com/Sylius/Sylius/releases/tag/v1.11.2 · Note
• https://t.me/cvenotify/53443 · Telegram Post
• https://t.me/cibsecurity/38907 · Telegram Post