CVE-2024-34349 Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel
Attackers can inject JavaScript via Name fields in the Sylius admin panel, potentially leading to code execution or account takeover.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-34349?
CVE-2024-34349 is a medium-severity cross-site scripting vulnerability in Sylius, published on 10 May 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Sylius is an open source eCommerce platform. Prior to 1.12.16 and 1.13.1, there is a possibility to execute javascript code in the Admin panel. In order to perform an XSS attack input a script into Name field in which of the resources: Taxons, Products, Product Options or Product Variants. The code will be executed while using an autocomplete field with one of the listed entities in the Admin Panel. Also for the taxons in the category tree on the product form.The issue is fixed in versions: 1.12.16, 1.13.1.
Weakness: CWE-79
Which versions are affected by CVE-2024-34349?
10 open source packages ship an affected version, including sylius/sylius.
| Package | Affected | Fixed in |
|---|---|---|
sylius/sylius Packagist | All versions | 1.9.12 |
sylius/sylius Packagist | All versions | 1.9.12 |
sylius/sylius Packagist | From 1.10.0-alpha.1 | 1.10.16 |
sylius/sylius Packagist | From 1.10.0-alpha.1 | 1.10.16 |
sylius/sylius Packagist | From 1.11.0-alpha.1 | 1.11.17 |
sylius/sylius Packagist | From 1.11.0-alpha.1 | 1.11.17 |
4 more packages
sylius/sylius Packagist | From 1.12.0-alpha.1 | 1.12.16 |
sylius/sylius Packagist | From 1.12.0-alpha.1 | 1.12.16 |
sylius/sylius Packagist | From 1.13.0-alpha.1 | 1.13.1 |
sylius/sylius Packagist | From 1.13.0-alpha.1 | 1.13.1 |
How do I fix CVE-2024-34349?
Upgrade sylius/sylius to a fixed version for your release line: 1.9.12, 1.10.16, 1.11.17 or 1.12.16.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-34349 being exploited?
There is no known exploitation of CVE-2024-34349 in the wild and no public exploit code.
Sources
Also known as GHSA-v2f9-rv6w-vw8r.