CVE-2022-24752
Severity CVSS v4.0:
Pending analysis
Type:
CWE-89
SQL Injection
Publication date:
15/03/2022
Last modified:
25/03/2022
Description
SyliusGridBundle is a package of generic data grids for Symfony applications. Prior to versions 1.10.1 and 1.11-rc2, values added at the end of query sorting were passed directly to the database. The maintainers do not know if this could lead to direct SQL injections but took steps to remediate the vulnerability. The issue is fixed in versions 1.10.1 and 1.11-rc2. As a workaround, overwrite the`Sylius\Component\Grid\Sorting\Sorter.php` class and register it in the container. More information about this workaround is available in the GitHub Security Advisory.
Impact
Base Score 3.x
9.80
Severity 3.x
CRITICAL
Base Score 2.0
7.50
Severity 2.0
HIGH
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:sylius:syliusgridbundle:*:*:*:*:*:*:*:* | 1.10.1 (excluding) | |
cpe:2.3:a:sylius:syliusgridbundle:1.11.0:-:*:*:*:*:*:* | ||
cpe:2.3:a:sylius:syliusgridbundle:1.11.0:alpha1:*:*:*:*:*:* | ||
cpe:2.3:a:sylius:syliusgridbundle:1.11.0:beta1:*:*:*:*:*:* | ||
cpe:2.3:a:sylius:syliusgridbundle:1.11.0:rc1:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://github.com/Sylius/SyliusGridBundle/commit/73d0791d0575f955e830a3da4c3345f420d2f784
- https://github.com/Sylius/SyliusGridBundle/pull/222
- https://github.com/Sylius/SyliusGridBundle/releases/tag/v1.10.1
- https://github.com/Sylius/SyliusGridBundle/releases/tag/v1.11.0-RC.2
- https://github.com/Sylius/SyliusGridBundle/security/advisories/GHSA-2xmm-g482-4439