CVE-2019-12186

描述

Grid component of Sylius omits HTML input sanitisation while rendering object implementing __toString() method through the string field type.

受影響套件(3)

• Packagist/sylius/grid>= 1.0.0, < 1.1.19
• Packagist/sylius/grid-bundle>= 1.0.0, < 1.1.19
• Packagist/sylius/sylius>= 1.0.0, < 1.1.18

CVSS 分數

參考連結(4)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2019-12186
• WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/grid/CVE-2019-12186.yaml
• WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/sylius/CVE-2019-12186.yaml
• WEBhttps://sylius.com/blog/cve-2019-12186