Medium severity · published Dec 5, 2019
CVE-2019-16768
In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by…
4.3
CVSS
0.7%
EPSS
No
On KEV
Description
In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation message with the exception details will be presented to the user when one will try to log into the shop. This has been patched in versions 1.3.14, 1.4.10, 1.5.7, and 1.6.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Sylius · Sylius
before 1.3.14; 1.4.0 before 1.4.10; 1.5.0 before 1.5.7; 1.6.0 before 1.6.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-16768
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-16768
Release Notes
https://github.com/Sylius/Sylius/commit/be245302dfc594d8690fe50dd47631d186aa945f
Mitigation
https://github.com/Sylius/Sylius/security/advisories/GHSA-3r8j-pmch-5j2h
More from Sylius
8.8
CVE-2026-100871
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
8.8
CVE-2026-100870
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header
8.2
CVE-2022-24743
Sylius is an open source eCommerce platform
7.5
CVE-2026-100872
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
7.5
CVE-2024-57610
A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account…