CVE-2019-12186
Estado: ModificadaMedia (4.8)—
An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the "string" field type. The contents are an object, with malicious code returned by the __toString() method of that object.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- Puntuación base: 4.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.55%
- Percentil entre todas las CVEs puntuadas: 44
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-79
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2019-12186",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 3.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"authentication": "SINGLE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "LOW",
"obtainAllPrivilege": false,
"exploitabilityScore": 6.8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 4.8,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "HIGH",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 1.7
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2019-12-31T15:15:10.957",
"references": [
{
"url": "https://sylius.com/blog/cve-2019-12186/",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://sylius.com/blog/cve-2019-12186/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the \"string\" field type. The contents are an object, with malicious code returned by the __toString() method of that object."
},
{
"lang": "es",
"value": "Se descubrió un problema en los productos Sylius. Una perdida de saneamiento de la entrada en sylius/sylius versiones 1.0.x hasta 1.0.18, 1.1.x hasta 1.1.17, 1.2.x hasta 1.2.16, 1.3.x hasta 1.3.11 y 1.4.x hasta 1.4.3 y sylius/grid versiones 1.0.x hasta 1.0.18, versiones 1.1.x hasta 1.1.18, versiones 1.2.x hasta 1.2.17, versiones 1.3.x hasta 1.3.12, versiones 1.4.x hasta 1.4.4 y versión 1.5.0, permite a un atacante (un administrador en el caso de sylius/sylius) llevar a cabo un ataque de tipo XSS mediante una inyección de código malicioso en un campo que se muestra en una cuadrícula con el tipo de campo \"string\". El contenido es un objeto, con código malicioso devuelto por el método __toString() de ese objeto."
}
],
"lastModified": "2026-06-17T02:14:13.150",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sylius:grid:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AC911003-6FB4-4013-878E-2696E5FBDB45",
"versionEndIncluding": "1.0.18",
"versionStartIncluding": "1.0.0"
},
{
"criteria": "cpe:2.3:a:sylius:grid:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E46AF7C5-BFCD-4533-8F88-889E7D232178",
"versionEndIncluding": "1.1.18",
"versionStartIncluding": "1.1.0"
},
{
"criteria": "cpe:2.3:a:sylius:grid:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "17C678EC-4743-4502-9D43-058723BEB637",
"versionEndIncluding": "1.2.17",
"versionStartIncluding": "1.2.0"
},
{
"criteria": "cpe:2.3:a:sylius:grid:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "54FE2F5A-AF55-4A65-9E0F-15B376C58082",
"versionEndIncluding": "1.3.12",
"versionStartIncluding": "1.3.0"
},
{
"criteria": "cpe:2.3:a:sylius:grid:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CB208C61-D7DB-4A34-BB81-7F03361F5C70",
"versionEndIncluding": "1.4.4",
"versionStartIncluding": "1.4.0"
},
{
"criteria": "cpe:2.3:a:sylius:grid:1.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8B826636-EE5E-43D0-B232-4F927FC3DDD5"
},
{
"criteria": "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8BA67723-4EFB-4EE2-A3BE-4260C94EA2DE",
"versionEndIncluding": "1.0.18",
"versionStartIncluding": "1.0.0"
},
{
"criteria": "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D8687DE9-3CE1-4D96-B9FC-0EDAD2E40364",
"versionEndIncluding": "1.1.17",
"versionStartIncluding": "1.1.0"
},
{
"criteria": "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8009B7D8-1286-456D-861D-CB5D10E72923",
"versionEndIncluding": "1.2.16",
"versionStartIncluding": "1.2.0"
},
{
"criteria": "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "900547C2-8641-4430-ACEA-CDEF046D69D4",
"versionEndIncluding": "1.3.11",
"versionStartIncluding": "1.3.0"
},
{
"criteria": "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "188939AC-CC0A-496C-BCD4-25934D8BAADE",
"versionEndIncluding": "1.4.3",
"versionStartIncluding": "1.4.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}