CVE-2021-3841

Stored Cross-site Scripting (XSS) in sylius/sylius

State: Published
Severity: 4.1 Medium
Published: Nov 15, 2024
Updated: Nov 20, 2024
Reserved: Sep 30, 2021

Description

sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of the user's browser.

Scores

CVSS	Score	Vector	Source
3.0	4.1 Medium	CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L	@huntr_ai

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
sylius/syliussylius	before 1.9.10, 1.10.11, 1.11.2Affected

References

https://huntr.com/bounties/1625506791178-Sylius/Sylius
https://github.com/sylius/sylius/commit/3da169e0c23e752974d74223cc536c29a2a82edc

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.