CVE-2022-24752

Packagist/sylius/grid-bundle CVE-2022-24752: critical 9.8, EPSS 1.39%

DQL injection through sorting parameters blocked

Action: Upgrade sylius/grid-bundle to 1.10.1 or later.

composer require sylius/grid-bundle:1.10.1

Affected

Fixed versions

Sources

• osv: GHSA-2xmm-g482-4439
• https://github.com/Sylius/SyliusGridBundle/security/advisories/GHSA-2xmm-g482-4439
• https://nvd.nist.gov/vuln/detail/CVE-2022-24752
• https://github.com/Sylius/SyliusGridBundle/pull/222
• https://github.com/Sylius/SyliusGridBundle/commit/73d0791d0575f955e830a3da4c3345f420d2f784
• https://github.com/Sylius/SyliusGridBundle
• https://github.com/Sylius/SyliusGridBundle/releases/tag/v1.10.1
• https://github.com/Sylius/SyliusGridBundle/releases/tag/v1.11.0-RC.2

CVE-2022-24752 · published 2022-03-15T19:09:16Z · modified 2023-11-08T04:08:35.185536Z · JSON