CVE-2019-16768lowCWE-209

CVE-2019-16768: fallo de gravedad baja en Sylius

Internal exception message exposure for login action in Sylius

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Sylius+ Monitorear sylius/sylius

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 3.5epss 0.7%
In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation message with the exception details will be presented to the user when one will try to log into the shop. This has been patched in versions 1.3.14, 1.4.10, 1.5.7, and 1.6.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Productos afectados
Sylius · Sylius
CVEs relacionadas — Sylius

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-24743HIGHInsufficient Session Expiration in SyliusEPSS 1.3%CVE-2022-24749MEDIUMBasic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in SyliusEPSS 1.1%CVE-2022-24733MEDIUMImproper Restriction of Rendered UI Layers or Frames in SyliusEPSS 0.9%CVE-2021-32720MEDIUMList of order ids, number, items total and token value exposed for unauthorized uses via new APIEPSS 0.9%CVE-2022-24742MEDIUMExposure of Sensitive Information Due to Incompatible Policies in SyliusEPSS 0.8%CVE-2020-15245MEDIUMEmail verification bypass in SyliusEPSS 0.6%