CVE-2019-12186: XSS injection in the Grid component of Sylius

Quick answers

Is CVE-2019-12186 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-12186 being exploited in the wild.

How severe is CVE-2019-12186?

Low severity, with a CVSS score of 3.1, published 15 April 2020.

Which products and versions are affected?

sylius/grid (Packagist) ECOSYSTEM:introduced=1.0.0,fixed=1.1.19; sylius/grid-bundle (Packagist) ECOSYSTEM:introduced=1.0.0,fixed=1.1.19; sylius/sylius (Packagist) ECOSYSTEM:introduced=1.0.0,fixed=1.1.18.

Is there a fix for CVE-2019-12186?

Yes. sylius/grid (Packagist): upgrade to 1.1.19 or later; sylius/grid-bundle (Packagist): upgrade to 1.1.19 or later; sylius/sylius (Packagist): upgrade to 1.1.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2019-12186?

Check whether you run sylius/grid (Packagist), sylius/grid-bundle (Packagist) or sylius/sylius (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

• sylius/grid (Packagist): upgrade to 1.1.19 or later

  composer require sylius/grid:^1.1.19

• sylius/grid-bundle (Packagist): upgrade to 1.1.19 or later

  composer require sylius/grid-bundle:^1.1.19

• sylius/sylius (Packagist): upgrade to 1.1.18 or later

  composer require sylius/sylius:^1.1.18

Affected products

• sylius/grid (Packagist) ECOSYSTEM:introduced=1.0.0,fixed=1.1.19
• sylius/grid-bundle (Packagist) ECOSYSTEM:introduced=1.0.0,fixed=1.1.19
• sylius/sylius (Packagist) ECOSYSTEM:introduced=1.0.0,fixed=1.1.18

Identifiers

• CVE-2019-12186
• GHSA-rc5r-697f-28x6