CVE-2022-24733

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface with a different interface provided by the attacker. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. Every response from app should have an X-Frame-Options header set to: ``sameorigin``. To achieve that, add a new `subscriber` in the app.

CVSS v3 6.1 MEDIUM
CVSS v2.0 5.8 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

5.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability : 8.6 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/Sylius/Sylius/releases/tag/v1.10.11	Release Notes Third Party Advisory
https://github.com/Sylius/Sylius/releases/tag/v1.11.2	Release Notes Third Party Advisory
https://github.com/Sylius/Sylius/releases/tag/v1.9.10	Release Notes Third Party Advisory
https://github.com/Sylius/Sylius/security/advisories/GHSA-4jp3-q2qm-9fmw	Mitigation Third Party Advisory
https://github.com/Sylius/Sylius/releases/tag/v1.10.11	Release Notes Third Party Advisory
https://github.com/Sylius/Sylius/releases/tag/v1.11.2	Release Notes Third Party Advisory
https://github.com/Sylius/Sylius/releases/tag/v1.9.10	Release Notes Third Party Advisory
https://github.com/Sylius/Sylius/security/advisories/GHSA-4jp3-q2qm-9fmw	Mitigation Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sylius:sylius::::::::
	cpe:2.3:a:sylius:sylius::::::::
	cpe:2.3:a:sylius:sylius::::::::

History

No history.

Information

Published : 2022-03-14 19:15

Updated : 2024-11-21 06:50

NVD link : CVE-2022-24733

Mitre link : CVE-2022-24733

CVE.ORG link : CVE-2022-24733

JSON object : View

Products Affected

sylius

sylius

CWE

CWE-1021

Improper Restriction of Rendered UI Layers or Frames

{"id": "CVE-2022-24733", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2022-03-14T19:15:12.173", "references": [{"url": "https://github.com/Sylius/Sylius/releases/tag/v1.10.11", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Sylius/Sylius/releases/tag/v1.11.2", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Sylius/Sylius/releases/tag/v1.9.10", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Sylius/Sylius/security/advisories/GHSA-4jp3-q2qm-9fmw", "tags": ["Mitigation", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Sylius/Sylius/releases/tag/v1.10.11", "tags": ["Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/Sylius/Sylius/releases/tag/v1.11.2", "tags": ["Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/Sylius/Sylius/releases/tag/v1.9.10", "tags": ["Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/Sylius/Sylius/security/advisories/GHSA-4jp3-q2qm-9fmw", "tags": ["Mitigation", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1021"}]}], "descriptions": [{"lang": "en", "value": "Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface with a different interface provided by the attacker. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. Every response from app should have an X-Frame-Options header set to: ``sameorigin``. To achieve that, add a new `subscriber` in the app."}, {"lang": "es", "value": "Sylius es una plataforma de comercio electr\u00f3nico de c\u00f3digo abierto. En versiones anteriores a 1.9.10, 1.10.11 y 1.11.2, es posible que una p\u00e1gina controlada por un atacante cargue el sitio web dentro de un iframe. Esto permitir\u00eda un ataque de clickjacking, en el que la p\u00e1gina del atacante superpone la interfaz de la aplicaci\u00f3n objetivo con una interfaz diferente proporcionada por el atacante. El problema ha sido corregido en versiones 1.9.10, 1.10.11 y 1.11.2. Se presenta una medida de mitigaci\u00f3n disponible. Cada respuesta de la aplicaci\u00f3n debe tener un encabezado X-Frame-Options configurada como \"sameorigin\". Para conseguirlo, a\u00f1ada un nuevo \"subscriber\" en la aplicaci\u00f3n"}], "lastModified": "2024-11-21T06:50:58.550", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E2B404E6-8985-428A-A7C4-880A4947766B", "versionEndExcluding": "1.9.10"}, {"criteria": "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "687E9BB6-A926-4A62-B44E-7A1B236D6C6F", "versionEndExcluding": "1.10.11", "versionStartIncluding": "1.10.0"}, {"criteria": "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4D032BB-B314-42A5-808D-5861B909F76F", "versionEndExcluding": "1.11.2", "versionStartIncluding": "1.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}