CVE-2022-24742mediumCWE-200

CVE-2022-24742: medium-severity vulnerability in Sylius

Exposure of Sensitive Information Due to Incompatible Policies in Sylius

Published · Updated

Follow this CVE+ Monitor Sylius+ Monitor sylius/sylius

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5epss 0.8%
Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect to login page even browser back button is pressed. Another possibility is to set more strict cache policies for restricted content.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected products
Sylius · Sylius
Related CVEs — Sylius

In the same product, most dangerous first.

CVE-2022-24743HIGHInsufficient Session Expiration in SyliusEPSS 1.3%CVE-2022-24749MEDIUMBasic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in SyliusEPSS 1.1%CVE-2022-24733MEDIUMImproper Restriction of Rendered UI Layers or Frames in SyliusEPSS 0.9%CVE-2021-32720MEDIUMList of order ids, number, items total and token value exposed for unauthorized uses via new APIEPSS 0.9%CVE-2019-16768LOWInternal exception message exposure for login action in SyliusEPSS 0.7%CVE-2020-15245MEDIUMEmail verification bypass in SyliusEPSS 0.6%