GHSA-hhvr-2q69-4563

ghsaUSosv

Cross site scripting in sylius/sylius

view advisory published 2024-11-15Licence: CC-BY-4.0

sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of the user's browser.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-3841US	medium5.4	0.26% (17th)	—	2024-11-15
sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files. This vulnerability allows attackers to inject mal…

references

External citations — patches, advisories, analysis.

https://github.com/sylius/syliusPACKAGE
https://github.com/sylius/sylius/commit/3da169e0c23e752974d74223cc536c29a2a82edcWEB
https://huntr.com/bounties/1625506791178-Sylius/SyliusWEB
https://nvd.nist.gov/vuln/detail/CVE-2021-3841ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan