{"id":"CVE-2019-12186","published":"2019-12-31T14:21:39Z","modified":"2024-08-04T23:10:30Z","title":"An issue was discovered in Sylius products","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the \"string\" field type. The contents are an object, with malicious code returned by the __toString() method of that object.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00552,"percentile":0.46006,"provenance":"source"},"cwes":[],"references":[{"url":"https://sylius.com/blog/cve-2019-12186/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":9.2,"factors":[{"name":"EPSS percentile","points":9.2}]},"affected":[{"ecosystem":"Packagist","package":"sylius/grid","vulnerableRanges":[">=1.0.0, <1.1.19",">=1.2.0, <1.2.18",">=1.3.0, <1.3.13",">=1.4.0, <1.4.5",">=1.5.0, <1.5.1"],"patched":["1.1.19","1.2.18","1.3.13","1.4.5","1.5.1"],"from":["GHSA-rc5r-697f-28x6"],"provenance":"source"},{"ecosystem":"Packagist","package":"sylius/grid-bundle","vulnerableRanges":[">=1.0.0, <1.1.19",">=1.2.0, <1.2.18",">=1.3.0, <1.3.13",">=1.4.0, <1.4.5",">=1.5.0, <1.5.1"],"patched":["1.1.19","1.2.18","1.3.13","1.4.5","1.5.1"],"from":["GHSA-rc5r-697f-28x6"],"provenance":"source"},{"ecosystem":"Packagist","package":"sylius/sylius","vulnerableRanges":[">=1.0.0, <1.1.18",">=1.2.0, <1.2.17",">=1.3.0, <1.3.12",">=1.4.0, <1.4.4"],"patched":["1.1.18","1.2.17","1.3.12","1.4.4"],"from":["GHSA-rc5r-697f-28x6"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0393","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2019-12186","published":"2019-12-31","fixed":"1.4.4","kev":false},{"cve":"CVE-2020-5220","published":"2020-01-27","fixed":"1.4.4","kev":false,"link":{"from":"CVE-2019-12186","to":"CVE-2020-5220","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:sylius/sylius","fromFixed":"1.2.17","toFixed":"1.3.12","daysApart":27}]}},{"cve":"CVE-2019-16768","published":"2019-12-05","fixed":"1.6.3","kev":false},{"cve":"CVE-2020-5218","published":"2020-01-27","fixed":"1.6.5","kev":false}],"package":"Packagist:sylius/sylius"}}