CVE-2022-24733 Improper Restriction of Rendered UI Layers or Frames in Sylius

What is CVE-2022-24733?

CVE-2022-24733 is a medium-severity vulnerability in Sylius, published on 14 Mar 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface with a different interface provided by the attacker. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. Every response from app should have an X-Frame-Options header set to: ``sameorigin``. To achieve that, add a new `subscriber` in the app.

Weakness: CWE-1021

Which versions are affected by CVE-2022-24733?

6 open source packages ship an affected version, including sylius/sylius. It affects 1 product.

Products include Sylius Sylius.

How do I fix CVE-2022-24733?

Upgrade sylius/sylius to a fixed version for your release line: 1.9.10, 1.10.11 or 1.11.2.

Is CVE-2022-24733 being exploited?

There is no known exploitation of CVE-2022-24733 in the wild and no public exploit code.

Other vulnerabilities in Sylius

• CVE-2026-31824 Sylius has a Promotion Usage Limit Bypass via Race Condition High 8.2
• CVE-2024-57610 Denial of service in n/a High 7.5
• CVE-2026-31820 Sylius affected by IDOR in Cart and Checkout LiveComponents High 7.1
• CVE-2022-24743 Insufficient Session Expiration in Sylius High 7.1
• CVE-2026-31819 Sylius has an Open Redirect via Referer Header Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4jp3-q2qm-9fmw.