CVE-2022-24752
Description
SyliusGridBundle is a package of generic data grids for Symfony applications. Prior to versions 1.10.1 and 1.11-rc2, values added at the end of query sorting were passed directly to the database. The maintainers do not know if this could lead to direct SQL injections but took steps to remediate the vulnerability. The issue is fixed in versions 1.10.1 and 1.11-rc2. As a workaround, overwrite the`Sylius\Component\Grid\Sorting\Sorter.php` class and register it in the container. More information about this workaround is available in the GitHub Security Advisory.
How to fix
- sylius syliusgridbundle1.10.1 or later
- sylius/grid-bundle1.10.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sylius syliusgridbundle | v < 1.10.1, 1.11.0 | 1.10.1 |
| sylius/grid-bundlePackagist | v < 1.10.1 | 1.10.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.