CVE-2026-31819

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31819", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-09T17:41:56.076Z", "datePublished": "2026-03-10T21:18:59.634Z", "dateUpdated": "2026-03-11T15:59:59.496Z"}, "containers": {"cna": {"title": "Sylius has an Open Redirect via Referer Header", "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L", "version": "4.0"}}], "references": [{"name": "https://github.com/Sylius/Sylius/security/advisories/GHSA-9ffx-f77r-756w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Sylius/Sylius/security/advisories/GHSA-9ffx-f77r-756w"}], "affected": [{"vendor": "Sylius", "product": "Sylius", "versions": [{"version": ">= 2.2.0, < 2.2.3", "status": "affected"}, {"version": ">= 2.1.0, < 2.1.12", "status": "affected"}, {"version": ">= 2.0.0, < 2.0.16", "status": "affected"}, {"version": ">= 1.14.0, < 1.14.18", "status": "affected"}, {"version": ">= 1.13.0, < 1.13.15", "status": "affected"}, {"version": ">= 1.12.0, < 1.12.23", "status": "affected"}, {"version": ">= 1.11.0, < 1.11.17", "status": "affected"}, {"version": ">= 1.10.0, < 1.10.16", "status": "affected"}, {"version": "< 1.9.12", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T21:18:59.634Z"}, "descriptions": [{"lang": "en", "value": "Sylius is an Open Source eCommerce Framework on Symfony. CurrencySwitchController::switchAction(), ImpersonateUserController::impersonateAction() and StorageBasedLocaleSwitcher::handle() use the HTTP Referer header directly when redirecting. The attack requires the victim to click a legitimate application link placed on an attacker-controlled page. The browser automatically sends the attacker's site as the Referer, and the application redirects back to it. This can be used for phishing or credential theft, as the redirect originates from a trusted domain. The severity varies by endpoint; public endpoints require no authentication and are trivially exploitable, while admin-only endpoints require an authenticated session but remain vulnerable if an admin follows a link from an external source such as email or chat. The issue is fixed in versions: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3 and above."}], "source": {"advisory": "GHSA-9ffx-f77r-756w", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T15:53:35.200954Z", "id": "CVE-2026-31819", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T15:59:59.496Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Sylius has an Open Redirect via Referer Header", "source": {"advisory": "GHSA-9ffx-f77r-756w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "Sylius", "product": "Sylius", "versions": [{"status": "affected", "version": ">= 2.2.0, < 2.2.3"}, {"status": "affected", "version": ">= 2.1.0, < 2.1.12"}, {"status": "affected", "version": ">= 2.0.0, < 2.0.16"}, {"status": "affected", "version": ">= 1.14.0, < 1.14.18"}, {"status": "affected", "version": ">= 1.13.0, < 1.13.15"}, {"status": "affected", "version": ">= 1.12.0, < 1.12.23"}, {"status": "affected", "version": ">= 1.11.0, < 1.11.17"}, {"status": "affected", "version": ">= 1.10.0, < 1.10.16"}, {"status": "affected", "version": "< 1.9.12"}]}], "references": [{"url": "https://github.com/Sylius/Sylius/security/advisories/GHSA-9ffx-f77r-756w", "name": "https://github.com/Sylius/Sylius/security/advisories/GHSA-9ffx-f77r-756w", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Sylius is an Open Source eCommerce Framework on Symfony. CurrencySwitchController::switchAction(), ImpersonateUserController::impersonateAction() and StorageBasedLocaleSwitcher::handle() use the HTTP Referer header directly when redirecting. The attack requires the victim to click a legitimate application link placed on an attacker-controlled page. The browser automatically sends the attacker's site as the Referer, and the application redirects back to it. This can be used for phishing or credential theft, as the redirect originates from a trusted domain. The severity varies by endpoint; public endpoints require no authentication and are trivially exploitable, while admin-only endpoints require an authenticated session but remain vulnerable if an admin follows a link from an external source such as email or chat. The issue is fixed in versions: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3 and above."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T21:18:59.634Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31819", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T15:53:35.200954Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-11T15:53:36.532Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-31819", "state": "PUBLISHED", "dateUpdated": "2026-03-10T21:18:59.634Z", "dateReserved": "2026-03-09T17:41:56.076Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-10T21:18:59.634Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Sylius", "vendor": "Sylius", "versions": [{"status": "affected", "version": ">= 2.2.0, < 2.2.3"}, {"status": "affected", "version": ">= 2.1.0, < 2.1.12"}, {"status": "affected", "version": ">= 2.0.0, < 2.0.16"}, {"status": "affected", "version": ">= 1.14.0, < 1.14.18"}, {"status": "affected", "version": ">= 1.13.0, < 1.13.15"}, {"status": "affected", "version": ">= 1.12.0, < 1.12.23"}, {"status": "affected", "version": ">= 1.11.0, < 1.11.17"}, {"status": "affected", "version": ">= 1.10.0, < 1.10.16"}, {"status": "affected", "version": "< 1.9.12"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*", "matchCriteriaId": "51770D35-6AE8-496E-96BC-66EB6BCE7B40", "versionEndExcluding": "1.9.12", "vulnerable": true}, {"criteria": "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*", "matchCriteriaId": "2A470C5F-0EA5-44E7-8972-DBD12E239521", "versionEndExcluding": "1.10.16", "versionStartIncluding": "1.10.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*", "matchCriteriaId": "7BA83BA2-99AF-472A-A1A0-C3E816124261", "versionEndExcluding": "1.11.17", "versionStartIncluding": "1.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*", "matchCriteriaId": "429D1774-7663-41CF-97B5-864341D416B6", "versionEndExcluding": "1.12.23", "versionStartIncluding": "1.12.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*", "matchCriteriaId": "90B50358-6686-4FCC-AFC3-581927B851A3", "versionEndExcluding": "1.13.15", "versionStartIncluding": "1.13.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*", "matchCriteriaId": "8FC1AC20-9138-4CF3-81F5-A0CA777A693E", "versionEndExcluding": "1.14.18", "versionStartIncluding": "1.14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*", "matchCriteriaId": "DA9449ED-A73A-4D16-A464-DBCBE24CA6A6", "versionEndExcluding": "2.0.16", "versionStartIncluding": "2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*", "matchCriteriaId": "F45888BF-720D-4B78-BA7D-ED7E5E091A8C", "versionEndExcluding": "2.1.12", "versionStartIncluding": "2.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*", "matchCriteriaId": "9A2540B0-56B9-4B15-9876-BE908A80BB0A", "versionEndExcluding": "2.2.3", "versionStartIncluding": "2.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Sylius is an Open Source eCommerce Framework on Symfony. CurrencySwitchController::switchAction(), ImpersonateUserController::impersonateAction() and StorageBasedLocaleSwitcher::handle() use the HTTP Referer header directly when redirecting. The attack requires the victim to click a legitimate application link placed on an attacker-controlled page. The browser automatically sends the attacker's site as the Referer, and the application redirects back to it. This can be used for phishing or credential theft, as the redirect originates from a trusted domain. The severity varies by endpoint; public endpoints require no authentication and are trivially exploitable, while admin-only endpoints require an authenticated session but remain vulnerable if an admin follows a link from an external source such as email or chat. The issue is fixed in versions: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3 and above."}, {"lang": "es", "value": "Sylius es un Framework de eCommerce de C\u00f3digo Abierto en Symfony. CurrencySwitchController::switchAction(), ImpersonateUserController::impersonateAction() y StorageBasedLocaleSwitcher::handle() usan el encabezado HTTP Referer directamente al redirigir. El ataque requiere que la v\u00edctima haga clic en un enlace de aplicaci\u00f3n leg\u00edtimo colocado en una p\u00e1gina controlada por el atacante. El navegador env\u00eda autom\u00e1ticamente el sitio del atacante como Referer, y la aplicaci\u00f3n redirige de vuelta a \u00e9l. Esto puede usarse para phishing o robo de credenciales, ya que la redirecci\u00f3n se origina de un dominio de confianza. La severidad var\u00eda seg\u00fan el endpoint; los endpoints p\u00fablicos no requieren autenticaci\u00f3n y son trivialmente explotables, mientras que los endpoints solo para administradores requieren una sesi\u00f3n autenticada pero permanecen vulnerables si un administrador sigue un enlace de una fuente externa como correo electr\u00f3nico o chat. El problema est\u00e1 solucionado en las versiones: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3 y superiores."}], "id": "CVE-2026-31819", "lastModified": "2026-06-17T10:34:31.037", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31819", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T15:53:35.200954Z", "version": "2.0.3"}}]}, "published": "2026-03-10T22:16:19.323", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/Sylius/Sylius/security/advisories/GHSA-9ffx-f77r-756w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.2.0,2.2.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.1.0,2.1.12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.0.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.14.0,1.14.18)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.13.0,1.13.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.12.0,1.12.23)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.11.0,1.11.17)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.10.0,1.10.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.9.12)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Sylius", "source": "cna", "vendor": "Sylius"}, "product": "sylius", "vendor": "sylius"}], "analysis": {"en": {"generated_at": "2026-04-17T09:59:27.242655+00:00", "value": {"mitigation_remediation": ["Upgrade Sylius to any of the patched releases (1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3 or later).", "Modify the application code or configuration so that CurrencySwitchController, ImpersonateUserController, and StorageBasedLocaleSwitcher no longer use the Referer header as the redirect target, validating all redirect URLs against a whitelist of trusted domains.", "If an immediate patch is unavailable, configure the web server or a web application firewall to block redirects that point to external domains, allowing only redirects to trusted internal or whitelisted URLs."], "summary": {"action": "Immediate Patch", "impact": "Open Redirect enabling phishing or credential theft"}, "threat_synthesis": {"affected_systems": "Sylius eCommerce Framework on Symfony is affected. Vulnerable versions are those prior to 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, and 2.2.3. Any installation of Sylius before these releases is impacted.", "description_and_impact": "Sylius allows an attacker to redirect users to malicious sites via the HTTP Referer header in specific controller actions. The vulnerability lets an attacker deliver a link that looks legitimate, cause the browser to send the attacker's domain as the Referer, and then the shop redirects the user back to that malicious site. This can be exploited to harvest credentials or frame phishing pages, since the redirect originates from a trusted domain and does not require additional privileges.", "risk_and_exploitability": "The CVSS score of 6.9 indicates a moderate severity. Exploitation requires the victim to click a genuine looking link from an attacker-controlled page, which is trivial for public endpoints and moderately trivial for admin\u2011only endpoints if an authenticated admin follows an external link. The EPSS score is below 1\u202f%, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog."}}}}, "created": "2026-03-11T11:39:25.241438+00:00", "updated": "2026-04-17T10:00:03.575795+00:00", "vendors": ["sylius", "sylius$PRODUCT$sylius"]}