Skip to content
OpenAdvisories
Medium · 6.4 CVE-2024-29376 EUVD-2024-1500GHSA-7prj-9ccr-hr3q

Sylius has potential Cross Site Scripting vulnerability via the "Province" field in the Checkout and Address Book

Published Apr 22, 2024 · Updated Nov 22, 2024 · Assigned by mitre

Package: sylius/sylius Ecosystem: Packagist

Description

Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist sylius/sylius < 1.9.12 1.9.12 GHSA-7prj-9ccr-hr3q
Packagist sylius/sylius >= 1.10.0-alpha.1, < 1.10.16 1.10.16 GHSA-7prj-9ccr-hr3q
Packagist sylius/sylius >= 1.11.0-alpha.1, < 1.11.17 1.11.17 GHSA-7prj-9ccr-hr3q
Packagist sylius/sylius >= 1.12.0-alpha.1, < 1.12.16 1.12.16 GHSA-7prj-9ccr-hr3q
Packagist sylius/sylius >= 1.13.0-alpha.1, < 1.13.1 1.13.1 GHSA-7prj-9ccr-hr3q

References