CVE-2019-12186: XSS

Q: What is CVE-2019-12186?

CVE-2019-12186 is a vulnerability that allows for XSS injection in the Grid component of Sylius products.

Q: How severe is CVE-2019-12186?

CVE-2019-12186 has a severity rating of 4.8 out of 10.

Q: Which software versions are affected by CVE-2019-12186?

The affected software versions include sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3, and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.13, and 1.4.x through 1.4.5.

Q: How can I fix CVE-2019-12186?

To fix CVE-2019-12186, update your sylius/sylius, sylius/grid, and grid-bundle packages to version 1.5.1, 1.4.5, or 1.3.13 respectively.

Q: What is the Common Weakness Enumeration (CWE) of CVE-2019-12186?

The CWE of CVE-2019-12186 is CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

Published May 21, 2019

Updated

An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the "string" field type. The contents are an object, with malicious code returned by the toString() method of that object.

Other sources

CVE-2019-12186: XSS injection in the Grid component

Grid component of Sylius omits HTML input sanitisation while rendering object implementing toString() method through the string field type.

Affected Software

28 affected componentsFixes available

composer/sylius/grid>=1.0.0, <1.1.0, >=1.1.0, <1.1.19, >=1.2.0, <1.2.18, >=1.3.0, <1.3.13, >=1.4.0, <1.4.5, >=1.5.0, <1.5.1

composer/sylius/sylius>=1.0.0, <1.1.0, >=1.1.0, <1.1.18, >=1.2.0, <1.2.17, >=1.3.0, <1.3.12, >=1.4.0, <1.4.4

composer/sylius/grid-bundle>=1.0.0, <1.1.0, >=1.1.0, <1.1.19, >=1.2.0, <1.2.18, >=1.3.0, <1.3.13, >=1.4.0, <1.4.5, >=1.5.0, <1.5.1

composer/sylius/sylius>=1.4.0<1.4.4

1.4.4

composer/sylius/sylius>=1.3.0<1.3.12

1.3.12

composer/sylius/sylius>=1.2.0<1.2.17

1.2.17

composer/sylius/sylius>=1.0.0<1.1.18

1.1.18

composer/sylius/grid-bundle>=1.5.0<1.5.1

1.5.1

composer/sylius/grid-bundle>=1.4.0<1.4.5

1.4.5

composer/sylius/grid-bundle>=1.3.0<1.3.13

1.3.13

composer/sylius/grid-bundle>=1.2.0<1.2.18

1.2.18

composer/sylius/grid-bundle>=1.0.0<1.1.19

1.1.19

composer/sylius/grid>=1.5.0<1.5.1

1.5.1

composer/sylius/grid>=1.4.0<1.4.5

1.4.5

composer/sylius/grid>=1.3.0<1.3.13

1.3.13

composer/sylius/grid>=1.2.0<1.2.18

1.2.18

composer/sylius/grid>=1.0.0<1.1.19

1.1.19

Sylius Grid>=1.0.0<=1.0.18

Sylius Grid>=1.1.0<=1.1.18

Sylius Grid>=1.2.0<=1.2.17

Sylius Grid>=1.3.0<=1.3.12

Sylius Grid>=1.4.0<=1.4.4

Sylius Grid=1.5.0

Sylius Sylius>=1.0.0<=1.0.18

Sylius Sylius>=1.1.0<=1.1.17

Sylius Sylius>=1.2.0<=1.2.16

Sylius Sylius>=1.3.0<=1.3.11

Sylius Sylius>=1.4.0<=1.4.3

Event History

May 21, 2019

Advisory Published

02:01 PM

Dec 31, 2019

CVE Published

via MITRE·02:21 PM

Data Sourced

via MITRE·02:21 PM

Description

Frequently Asked Questions

What is CVE-2019-12186?

CVE-2019-12186 is a vulnerability that allows for XSS injection in the Grid component of Sylius products.

How severe is CVE-2019-12186?