In short
- CVE-2019-12186 is a MEDIUM (CVSS 4.8) vulnerability affecting sylius/grid, sylius/grid-bundle, sylius/sylius.
- Chance of exploitation in the next 30 days (EPSS): 0.55%, higher than 46.1% of all vulnerabilities.
- Fix: update to 1.1.19, 1.2.18, 1.3.13, 1.4.5 or later.
| Package | Affected versions | Patched versions |
|---|
| sylius/grid Packagist | ≥ 1.0.0, < 1.1.19≥ 1.2.0, < 1.2.18≥ 1.3.0, < 1.3.13≥ 1.4.0, < 1.4.5≥ 1.5.0, < 1.5.1
| 1.1.191.2.181.3.131.4.51.5.1
|
| sylius/grid-bundle Packagist | ≥ 1.0.0, < 1.1.19≥ 1.2.0, < 1.2.18≥ 1.3.0, < 1.3.13≥ 1.4.0, < 1.4.5≥ 1.5.0, < 1.5.1
| 1.1.191.2.181.3.131.4.51.5.1
|
| sylius/sylius Packagist | ≥ 1.0.0, < 1.1.18≥ 1.2.0, < 1.2.17≥ 1.3.0, < 1.3.12≥ 1.4.0, < 1.4.4
| 1.1.181.2.171.3.121.4.4
|
| grid | = 1.5.0≥ 1.0.0, ≤ 1.0.18≥ 1.1.0, ≤ 1.1.18≥ 1.2.0, ≤ 1.2.17≥ 1.3.0, ≤ 1.3.12≥ 1.4.0, ≤ 1.4.4
| No fix yet |
| sylius | ≥ 1.0.0, ≤ 1.0.18≥ 1.1.0, ≤ 1.1.17≥ 1.2.0, ≤ 1.2.16≥ 1.3.0, ≤ 1.3.11≥ 1.4.0, ≤ 1.4.3
| No fix yet |
Description
Grid component of Sylius omits HTML input sanitisation while rendering object implementing __toString() method through the string field type.
NVD description
An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the "string" field type. The contents are an object, with malicious code returned by the __toString() method of that object.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free