Login Request a demo
Medium severity · published Mar 14, 2022
CVE-2022-24742
Sylius is an open source eCommerce platform
5.5
CVSS
0.8%
EPSS
No
On KEV
Description
Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect to login page even browser back button is pressed. Another possibility is to set more strict cache policies for restricted content.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Sylius · Sylius
before 1.9.10; 1.10.0 before 1.10.11; 1.11.0 before 1.11.2 · source: NVD
Affected product
SY
Sylius
Sylius
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24742
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-24742
Release Notes
https://github.com/Sylius/Sylius/releases/tag/v1.10.11
Release Notes
https://github.com/Sylius/Sylius/releases/tag/v1.11.2
Release Notes
https://github.com/Sylius/Sylius/releases/tag/v1.9.10
Mitigation
https://github.com/Sylius/Sylius/security/advisories/GHSA-7563-75j9-6h5p
More from Sylius
8.8
CVE-2026-100871
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
8.8
CVE-2026-100870
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header
8.2
CVE-2022-24743
Sylius is an open source eCommerce platform
7.5
CVE-2026-100872
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
7.5
CVE-2024-57610
A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account…