PT-2024-22871 · Sylius · Sylius

Published 2024-04-22 · Updated 2025-09-15 · CVE-2024-29376

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sylius versions 1.12.13 through 1.12.15 Sylius versions prior to 1.13.1

Description The issue is related to Cross Site Scripting (XSS) via the "Province" field in Address Book. There is a possibility to save XSS code in the province field in the Checkout and Address Book and then execute it on these pages. The problem occurs when you open the address step page in the checkout or edit the address in the address book. This only affects the base UI Shop provided by Sylius.

Recommendations For Sylius versions 1.12.13 through 1.12.15, update to version 1.12.16 or later. For Sylius versions prior to 1.13.1, update to version 1.13.1 or later. As a temporary workaround, consider adding a custom JavaScript file assets/shop/sylius-province-field.js to sanitize the input in the province field, and then rebuild your assets using yarn build.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-29376

GHSA-7PRJ-9CCR-HR3Q

GHSA-MW82-6M2G-QH6C

Affected Products

Sylius

References · 9

• 🔥 https://github.com/r2tunes/Reports/blob/main/Sylius.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-29376 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29376 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7prj-9ccr-hr3q · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mw82-6m2g-qh6c · Vendor Advisory
• https://github.com/Sylius/Sylius · Note
• https://github.com/Sylius/Sylius/commit/fb0ecb275747e364f1d4744ed8605c57f9bd8a80 · Note
• https://github.com/Sylius/Sylius/security/advisories/GHSA-7prj-9ccr-hr3q · Note
• https://t.me/cveNotify/135481 · Telegram Post