CVE-2022-24752 SQL Injection through sorting parameters in SyliusGridBundle

2022-03-1514:40:13

CWE-89

GitHub_M

www.cve.org

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.8%

JSON

SyliusGridBundle is a package of generic data grids for Symfony applications. Prior to versions 1.10.1 and 1.11-rc2, values added at the end of query sorting were passed directly to the database. The maintainers do not know if this could lead to direct SQL injections but took steps to remediate the vulnerability. The issue is fixed in versions 1.10.1 and 1.11-rc2. As a workaround, overwrite theSylius\Component\Grid\Sorting\Sorter.php class and register it in the container. More information about this workaround is available in the GitHub Security Advisory.

CNA Affected

[
  {
    "product": "SyliusGridBundle",
    "vendor": "Sylius",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.10.1"
      },
      {
        "status": "affected",
        "version": "1.11-alpha, <= 1.11-rc"
      }
    ]
  }
]