CVE-2019-16768: falha de baixa gravidade em Sylius
Internal exception message exposure for login action in Sylius
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.5epss 0.7%
In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation message with the exception details will be presented to the user when one will try to log into the shop. This has been patched in versions 1.3.14, 1.4.10, 1.5.7, and 1.6.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Produtos afetados
Sylius · SyliusCVEs relacionadas — Sylius
No mesmo produto, das mais perigosas para as menos.
CVE-2022-24743HIGHInsufficient Session Expiration in SyliusEPSS 1.3%CVE-2022-24749MEDIUMBasic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in SyliusEPSS 1.1%CVE-2022-24733MEDIUMImproper Restriction of Rendered UI Layers or Frames in SyliusEPSS 0.9%CVE-2021-32720MEDIUMList of order ids, number, items total and token value exposed for unauthorized uses via new APIEPSS 0.9%CVE-2022-24742MEDIUMExposure of Sensitive Information Due to Incompatible Policies in SyliusEPSS 0.8%CVE-2020-15245MEDIUMEmail verification bypass in SyliusEPSS 0.6%