CVE-2022-24742: Exposure of Sensitive Information Due to Incompatible Policies in Sylius
Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect to login page even browser back button is pressed. Another possibility is to set more strict cache policies for restricted content.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-24742?
CVE-2022-24742 is a vulnerability in Sylius, an open source eCommerce platform, that allows any user to view data if the browser tab remains unclosed after log out.
How severe is CVE-2022-24742?
CVE-2022-24742 has a severity score of 5.5, which is considered medium.
Which versions of Sylius are affected by CVE-2022-24742?
Versions 1.9.10, 1.10.0 to 1.10.11, and 1.11.0 to 1.11.2 of Sylius are affected by CVE-2022-24742.
How can I fix CVE-2022-24742?
To fix CVE-2022-24742, you should update your Sylius installation to version 1.9.10, 1.10.11, or 1.11.2.
Is there a workaround for CVE-2022-24742?
Yes, a workaround is available for CVE-2022-24742. The application must strictly redirect to the login page after logout to prevent unauthorized access to data.