p PatchFirst

CVE-2019-12186

CVE-2019-12186

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the "string" field type. The contents are an object, with malicious code returned by the __toString() method of that object.

CVSS 4.8 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • sylius/grid Packagist

    Versions
    • v1.0.0
    • v1.0.1
    • v1.0.10
    • v1.0.11
    • v1.0.12
    • v1.0.13
    • v1.0.14
    • v1.0.15
    • v1.0.16
    • v1.0.17
    • v1.0.18
    • v1.0.2
    • v1.0.3
    • v1.0.4
    • v1.0.5
    • v1.0.6
    • v1.0.7
    • v1.0.8
    • v1.0.9
    • v1.1.0
    • v1.1.0-RC
    • v1.1.1
    • v1.1.10
    • v1.1.11
    • v1.1.12
    • v1.1.13
    • v1.1.14
    • v1.1.15
    • v1.1.17
    • v1.1.18
    • v1.1.2
    • v1.1.3
    • v1.1.4
    • v1.1.5
    • v1.1.6
    • v1.1.7
    • v1.1.8
    • v1.1.9
    Affected ranges
    • ECOSYSTEM: ≥ 1.0.0, < 1.1.19

    Update to 1.1.19

  • sylius/grid Packagist

    Versions
    • v1.2.0
    • v1.2.1
    • v1.2.10
    • v1.2.11
    • v1.2.12
    • v1.2.13
    • v1.2.14
    • v1.2.15
    • v1.2.16
    • v1.2.17
    • v1.2.2
    • v1.2.3
    • v1.2.4
    • v1.2.5
    • v1.2.6
    • v1.2.7
    • v1.2.8
    • v1.2.9
    Affected ranges
    • ECOSYSTEM: ≥ 1.2.0, < 1.2.18

    Update to 1.2.18

  • sylius/grid Packagist

    Versions
    • v1.3.0
    • v1.3.1
    • v1.3.10
    • v1.3.11
    • v1.3.12
    • v1.3.2
    • v1.3.3
    • v1.3.4
    • v1.3.5
    • v1.3.6
    • v1.3.7
    • v1.3.8
    • v1.3.9
    Affected ranges
    • ECOSYSTEM: ≥ 1.3.0, < 1.3.13

    Update to 1.3.13

  • sylius/grid Packagist

    Versions
    • v1.4.0
    • v1.4.1
    • v1.4.2
    • v1.4.3
    • v1.4.4
    Affected ranges
    • ECOSYSTEM: ≥ 1.4.0, < 1.4.5

    Update to 1.4.5

  • sylius/grid Packagist

    Versions
    • v1.5.0
    Affected ranges
    • ECOSYSTEM: ≥ 1.5.0, < 1.5.1

    Update to 1.5.1

  • sylius/grid-bundle Packagist

    Versions
    • 1.0.0-patch1
    • v1.0.0
    • v1.0.1
    • v1.0.10
    • v1.0.11
    • v1.0.12
    • v1.0.13
    • v1.0.14
    • v1.0.15
    • v1.0.16
    • v1.0.17
    • v1.0.18
    • v1.0.2
    • v1.0.3
    • v1.0.4
    • v1.0.5
    • v1.0.6
    • v1.0.7
    • v1.0.8
    • v1.0.9
    • v1.1.0
    • v1.1.0-RC
    • v1.1.1
    • v1.1.10
    • v1.1.11
    • v1.1.12
    • v1.1.13
    • v1.1.14
    • v1.1.15
    • v1.1.17
    • v1.1.18
    • v1.1.2
    • v1.1.3
    • v1.1.4
    • v1.1.5
    • v1.1.6
    • v1.1.7
    • v1.1.8
    • v1.1.9
    Affected ranges
    • ECOSYSTEM: ≥ 1.0.0, < 1.1.19

    Update to 1.1.19

  • sylius/grid-bundle Packagist

    Versions
    • 1.2.4-patch1
    • v1.2.0
    • v1.2.1
    • v1.2.10
    • v1.2.11
    • v1.2.12
    • v1.2.13
    • v1.2.14
    • v1.2.15
    • v1.2.16
    • v1.2.17
    • v1.2.2
    • v1.2.3
    • v1.2.4
    • v1.2.5
    • v1.2.6
    • v1.2.7
    • v1.2.8
    • v1.2.9
    Affected ranges
    • ECOSYSTEM: ≥ 1.2.0, < 1.2.18

    Update to 1.2.18

  • sylius/grid-bundle Packagist

    Versions
    • v1.3.0
    • v1.3.1
    • v1.3.10
    • v1.3.11
    • v1.3.12
    • v1.3.2
    • v1.3.3
    • v1.3.4
    • v1.3.5
    • v1.3.6
    • v1.3.7
    • v1.3.8
    • v1.3.9
    Affected ranges
    • ECOSYSTEM: ≥ 1.3.0, < 1.3.13

    Update to 1.3.13

  • sylius/grid-bundle Packagist

    Versions
    • 1.4.0-patch1
    • v1.4.0
    • v1.4.1
    • v1.4.2
    • v1.4.3
    • v1.4.4
    Affected ranges
    • ECOSYSTEM: ≥ 1.4.0, < 1.4.5

    Update to 1.4.5

  • sylius/grid-bundle Packagist

    Versions
    • v1.5.0
    Affected ranges
    • ECOSYSTEM: ≥ 1.5.0, < 1.5.1

    Update to 1.5.1

  • sylius/sylius Packagist

    Versions
    • v1.0.0
    • v1.0.1
    • v1.0.10
    • v1.0.11
    • v1.0.12
    • v1.0.13
    • v1.0.14
    • v1.0.15
    • v1.0.16
    • v1.0.17
    • v1.0.18
    • v1.0.2
    • v1.0.3
    • v1.0.4
    • v1.0.5
    • v1.0.6
    • v1.0.7
    • v1.0.8
    • v1.0.9
    • v1.1.0
    • v1.1.0-RC
    • v1.1.1
    • v1.1.10
    • v1.1.11
    • v1.1.12
    • v1.1.13
    • v1.1.14
    • v1.1.15
    • v1.1.16
    • v1.1.17
    • v1.1.2
    • v1.1.3
    • v1.1.4
    • v1.1.5
    • v1.1.6
    • v1.1.7
    • v1.1.8
    • v1.1.9
    Affected ranges
    • ECOSYSTEM: ≥ 1.0.0, < 1.1.18

    Update to 1.1.18

  • sylius/sylius Packagist

    Versions
    • v1.2.0
    • v1.2.1
    • v1.2.10
    • v1.2.11
    • v1.2.12
    • v1.2.13
    • v1.2.14
    • v1.2.15
    • v1.2.16
    • v1.2.2
    • v1.2.3
    • v1.2.4
    • v1.2.5
    • v1.2.6
    • v1.2.7
    • v1.2.8
    • v1.2.9
    Affected ranges
    • ECOSYSTEM: ≥ 1.2.0, < 1.2.17

    Update to 1.2.17

  • sylius/sylius Packagist

    Versions
    • v1.3.0
    • v1.3.1
    • v1.3.10
    • v1.3.11
    • v1.3.2
    • v1.3.3
    • v1.3.4
    • v1.3.5
    • v1.3.6
    • v1.3.7
    • v1.3.8
    • v1.3.9
    Affected ranges
    • ECOSYSTEM: ≥ 1.3.0, < 1.3.12

    Update to 1.3.12

  • sylius/sylius Packagist

    Versions
    • v1.4.0
    • v1.4.1
    • v1.4.2
    • v1.4.3
    Affected ranges
    • ECOSYSTEM: ≥ 1.4.0, < 1.4.4

    Update to 1.4.4

Original sources

Check your server →