CVE-2024-34349 - CVE House
Back to Database
Status published Medium CVE-2024-34349

Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel

Vulnerability Description

Sylius is an open source eCommerce platform. Prior to 1.12.16 and 1.13.1, there is a possibility to execute javascript code in the Admin panel. In order to perform an XSS attack input a script into Name field in which of the resources: Taxons, Products, Product Options or Product Variants. The code will be executed while using an autocomplete field with one of the listed entities in the Admin Panel. Also for the taxons in the category tree on the product form.The issue is fixed in versions: 1.12.16, 1.13.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-34349

Credits & Attribution

No credits recorded in the NVD database.

References

More from Sylius

View All →
CVE-2025-30152
Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout
Medium 6.5
CVE-2025-29788
Sylius PayPal Plugin Payment Amount Manipulation Vulnerability
Medium 6.5
CVE-2024-40633
Customer data leak via adjustments API endpoint in Sylius
Medium 5.3
CVE-2022-24752
SQL Injection through sorting parameters in SyliusGridBundle
Critical 9.8
CVE-2022-24749
Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius
Medium 6.1

Affected Vendor

Affected Software

Sylius
Vulnerable Versions:
< 1.12.16, >= 1.13.0-alpha.1, < 1.13.1

Timeline

Official Publish: May 10th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact