CVE-2022-24733mediumCWE-1021

CVE-2022-24733: medium-severity vulnerability in Sylius

Improper Restriction of Rendered UI Layers or Frames in Sylius

Published · Updated

Follow this CVE+ Monitor Sylius+ Monitor sylius/sylius

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.9%
In short

Sylius websites can be loaded inside an attacker's iframe, allowing clickjacking attacks where users are tricked into clicking on hidden elements. This vulnerability affects versions before 1.9.10, 1.10.11, and 1.11.2.

Technical detail

CWE-1021: Improper restriction of rendered UI layers enables clickjacking via iframe embedding. The vulnerability exists because responses lack X-Frame-Options headers, allowing any site to embed the application. Attackers can overlay malicious UI elements to trick users into unintended actions.

Summary generated and translated by AI from the official description.
Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface with a different interface provided by the attacker. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. Every response from app should have an X-Frame-Options header set to: ``sameorigin``. To achieve that, add a new `subscriber` in the app.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Sylius · Sylius
Related CVEs — Sylius

In the same product, most dangerous first.

CVE-2022-24743HIGHInsufficient Session Expiration in SyliusEPSS 1.3%CVE-2022-24749MEDIUMBasic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in SyliusEPSS 1.1%CVE-2021-32720MEDIUMList of order ids, number, items total and token value exposed for unauthorized uses via new APIEPSS 0.9%CVE-2022-24742MEDIUMExposure of Sensitive Information Due to Incompatible Policies in SyliusEPSS 0.8%CVE-2019-16768LOWInternal exception message exposure for login action in SyliusEPSS 0.7%CVE-2020-15245MEDIUMEmail verification bypass in SyliusEPSS 0.6%