CVE-2022-24733

Katalog CVE

CVSS 6.1 · Medium EPSS 0,91%

Kerentanan Improper Restriction of Rendered UI Layers or Frames pada sylius. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface with a different interface provided by the attacker. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. Every response from app should have an X-Frame-Options header set to: ``sameorigin``. To achieve that, add a new `subscriber` in the app.

Rincian

Terbit di NVD

14 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1021: Improper Restriction of Rendered UI Layers or Frames

EPSS (30 hari)

0,91% peluang dieksploitasi; lebih tinggi dari 58,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Sylius/Sylius/security/advisories/GHSA-4jp3-q2qm-9fmw mitigasi · advisory pihak ketiga
• https://github.com/Sylius/Sylius/releases/tag/v1.10.11 release notes · advisory pihak ketiga
• https://github.com/Sylius/Sylius/releases/tag/v1.11.2 release notes · advisory pihak ketiga
• https://github.com/Sylius/Sylius/releases/tag/v1.9.10 release notes · advisory pihak ketiga