Cross-Site Scripting Vulnerability in Sylius eCommerce Platform

CVE-2024-34349

What is CVE-2024-34349?

Sylius, an open-source eCommerce platform, has a vulnerability that allows for the execution of JavaScript code within the Admin panel prior to versions 1.12.16 and 1.13.1. This security flaw potentially enables attackers to perform cross-site scripting (XSS) attacks by injecting scripts into the Name fields of entities such as Taxons, Products, Product Options, or Product Variants. The malicious code could be executed through an autocomplete feature in the Admin Panel or within the category tree of taxons on product forms. Users are advised to upgrade to the latest fixed versions to safeguard their platforms against such attacks. For further details, visit the official security advisory here and the commit information here.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References