CVE-2022-24742

    Dashboard / Vulnerabilities / CVE-2022-24742

    CVE-2022-24742

    Published: 14 Mar 2022Last Modified: 21 Oct 2026

    Summary: Exposure of Sensitive Information Due to Incompatible Policies in Sylius

    Details: Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect to login page even browser back button is pressed. Another possibility is to set more strict cache policies for restricted content.

    References: https://github.com/Sylius/Sylius/releases/tag/v1.10.11, https://github.com/Sylius/Sylius/releases/tag/v1.11.2, https://github.com/Sylius/Sylius/releases/tag/v1.9.10, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24742.json, https://github.com/Sylius/Sylius/security/advisories/GHSA-7563-75j9-6h5p, https://nvd.nist.gov/vuln/detail/CVE-2022-24742

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -d7b8773600e69ccbcd6d498a77b98241c0049978

    Affected versions

    v1.11.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-24742 | CVE-DB