CVE-2019-12186 XSS injection in the Grid component of Sylius
An attacker with admin privileges can inject malicious scripts into grid fields, leading to cross-site scripting attacks in the Sylius e-commerce platform.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-12186?
CVE-2019-12186 is a medium-severity cross-site scripting vulnerability in n/a, published on 31 Dec 2019. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the "string" field type. The contents are an object, with malicious code returned by the __toString() method of that object.
Weakness: CWE-79
Which versions are affected by CVE-2019-12186?
28 open source packages ship an affected version, including sylius/grid, sylius/grid-bundle and sylius/sylius. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
sylius/grid Packagist | From 1.0.0 | 1.1.19 |
sylius/grid Packagist | From 1.0.0 | 1.1.19 |
sylius/grid Packagist | From 1.2.0 | 1.2.18 |
sylius/grid Packagist | From 1.2.0 | 1.2.18 |
sylius/grid Packagist | From 1.3.0 | 1.3.13 |
sylius/grid Packagist | From 1.3.0 | 1.3.13 |
22 more packages
sylius/grid Packagist | From 1.4.0 | 1.4.5 |
sylius/grid Packagist | From 1.4.0 | 1.4.5 |
sylius/grid Packagist | From 1.5.0 | 1.5.1 |
sylius/grid Packagist | From 1.5.0 | 1.5.1 |
sylius/grid-bundle Packagist | From 1.0.0 | 1.1.19 |
sylius/grid-bundle Packagist | From 1.0.0 | 1.1.19 |
sylius/grid-bundle Packagist | From 1.2.0 | 1.2.18 |
sylius/grid-bundle Packagist | From 1.2.0 | 1.2.18 |
sylius/grid-bundle Packagist | From 1.3.0 | 1.3.13 |
sylius/grid-bundle Packagist | From 1.3.0 | 1.3.13 |
sylius/grid-bundle Packagist | From 1.4.0 | 1.4.5 |
sylius/grid-bundle Packagist | From 1.4.0 | 1.4.5 |
sylius/grid-bundle Packagist | From 1.5.0 | 1.5.1 |
sylius/grid-bundle Packagist | From 1.5.0 | 1.5.1 |
sylius/sylius Packagist | From 1.0.0 | 1.1.18 |
sylius/sylius Packagist | From 1.0.0 | 1.1.18 |
sylius/sylius Packagist | From 1.2.0 | 1.2.17 |
sylius/sylius Packagist | From 1.2.0 | 1.2.17 |
sylius/sylius Packagist | From 1.3.0 | 1.3.12 |
sylius/sylius Packagist | From 1.3.0 | 1.3.12 |
sylius/sylius Packagist | From 1.4.0 | 1.4.4 |
sylius/sylius Packagist | From 1.4.0 | 1.4.4 |
Products include Sylius Grid, Sylius Sylius.
How do I fix CVE-2019-12186?
Upgrade sylius/grid to a fixed version for your release line: 1.1.19, 1.2.18, 1.3.13 or 1.4.5.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-12186 being exploited?
There is no known exploitation of CVE-2019-12186 in the wild and no public exploit code.
Sources
Also known as GHSA-rc5r-697f-28x6.