CVE-2022-24742CWE-200

Exposure of Sensitive Information Due to Incompatible Policies in Sylius

Medium · published March 14, 2022

CVSS v3.1
5.0
EPSS
1%
Percentile
56.9
In the wild
Unconfirmed
What it is

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect to login page even browser back button is pressed. Another possibility is to set more strict cache policies for restricted content.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00822 · 56.9th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-03-14T19:20Z
EPSS history
Timeline
  • 14 MAR 19:20Z
    Exposure of Sensitive Information Due to Incompatible Policies in Sylius
    cvelistv5