CVE-2021-3841: Stored Cross-site Scripting (XSS) in sylius/sylius

Q: What is the severity of CVE-2021-3841?

CVE-2021-3841 is rated as a medium severity vulnerability due to its potential to allow stored cross-site scripting (XSS) attacks.

Q: How do I fix CVE-2021-3841?

To fix CVE-2021-3841, update your Sylius installation to version 1.9.10, 1.10.11, or 1.11.2 or higher.

Q: Which versions of Sylius are affected by CVE-2021-3841?

CVE-2021-3841 affects Sylius versions prior to 1.9.10, 1.10.11, and 1.11.2.

Q: What kind of attack does CVE-2021-3841 enable?

CVE-2021-3841 enables attackers to perform stored cross-site scripting (XSS) via malicious SVG files.

Q: Who is affected by CVE-2021-3841?

Any user and administrator of affected Sylius versions could be exposed to risks associated with CVE-2021-3841.

Published Nov 15, 2024

Updated

sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of the user's browser.

Affected Software

6 affected componentsFixes available

composer/sylius/sylius>=1.11.0<1.11.2

1.11.2

composer/sylius/sylius>=1.10.0<1.10.11

1.10.11

composer/sylius/sylius<1.9.10

1.9.10

Sylius Sylius<1.9.10

Sylius Sylius>=1.10.0<1.10.11

Sylius Sylius>=1.11.0<1.11.2

Remediation

Patch Available

https://github.com/sylius/sylius/commit/3da169e0c23e752974d74223cc536c29a2a82edc

Event History

Nov 15, 2024

CVE Published

via MITRE·10:52 AM

Data Sourced

via MITRE·10:52 AM

DescriptionSeverityWeakness

Advisory Published

via GitHub·12:31 PM

Frequently Asked Questions

What is the severity of CVE-2021-3841?

CVE-2021-3841 is rated as a medium severity vulnerability due to its potential to allow stored cross-site scripting (XSS) attacks.

How do I fix CVE-2021-3841?