CVE-2019-16768: Internal exception message exposure for login action in Sylius
In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation message with the exception details will be presented to the user when one will try to log into the shop. This has been patched in versions 1.3.14, 1.4.10, 1.5.7, and 1.6.3.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-16768?
CVE-2019-16768 is a vulnerability in Sylius where exception messages from internal exceptions like database exceptions are wrapped and propagated, leading to the leakage of internal system information.
What is the severity of CVE-2019-16768?
The severity of CVE-2019-16768 is medium with a CVSS score of 4.3.
How does CVE-2019-16768 affect Sylius?
CVE-2019-16768 affects versions of Sylius up to 1.6.3, where exception messages from internal exceptions may be visible in the UI, leading to the leakage of internal system information.
How can I fix CVE-2019-16768?
To fix CVE-2019-16768, update your Sylius installation to versions 1.3.14, 1.4.10, 1.5.7, or 1.6.3 or later, which contain the necessary patches to address the vulnerability.
Where can I find more information about CVE-2019-16768?
You can find more information about CVE-2019-16768 in the following references: [Link 1](https://github.com/Sylius/Sylius/commit/be245302dfc594d8690fe50dd47631d186aa945f), [Link 2](https://github.com/Sylius/Sylius/security/advisories/GHSA-3r8j-pmch-5j2h).