Anonymity in Blockchain: Balancing Privacy and Security
CVE-2021-3841

5.4MEDIUM

Key Information:

Vendor

Sylius

Status
Sylius/sylius
Vendor
CVE Published:
15 November 2024

What is CVE-2021-3841?

The Sylius e-commerce platform is susceptible to stored cross-site scripting (XSS) vulnerabilities due to improper handling of SVG file uploads in versions prior to 1.9.10, 1.10.11, and 1.11.2. Attackers can exploit this flaw to inject malicious scripts, which could be executed within the context of an affected user's browser. This risk poses a significant threat to data integrity and user security, enabling potential unauthorized actions and data breaches. It is crucial for users of affected Sylius versions to apply updates and patches to mitigate this vulnerability.

Affected Version(s)

sylius/sylius < 1.9.10, 1.10.11, 1.11.2

References

https://huntr.com/bounties/1625506791178-Sylius/Sylius
https://github.com/sylius/sylius/commit/3da169e0c23e75297...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.