Every CVE Search/ Get API key

CVE-2024-29376

Sylius has potential Cross Site Scripting vulnerability via the "Province" field in the Checkout and Address Book

6.4 MediumFix available

Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.42%Up 0.4 points since Apr 23, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.4

Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book.

Record
CVE-2024-29376
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2024-1500 6.4

Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book.

Record
EUVD-2024-1500
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-7prj-9ccr-hr3q No score

Sylius has potential Cross Site Scripting vulnerability via the "Province" field in the Checkout and Address Book

Impact

There is a possibility to save XSS code in province field in the Checkout and Address Book and then execute it on these pages. The problem occurs when you open the address step page in the checkout or edit the address in the address book. This only affects the base UI Shop provided by Sylius.

Patches

The issue is fixed in versions: 1.9.12, 1.10.16, 1.11.17, 1.12.16, 1.13.1 and above.

Workarounds

  1. Create new file assets/shop/sylius-province-field.js:
// assets/shop/sylius-province-field.js

function sanitizeInput(input) {
  const div = document.createElement('div');
  div.textContent = input;
  return div.innerHTML; // Converts text content to plain HTML, stripping any scripts
}

const getProvinceInputValue = function getProvinceInputValue(valueSelector) {
  return valueSelector == undefined ? '' : `value="${sanitizeInput(valueSelector)}"`;
};

$.fn.extend({
  provinceField() {
    const countrySelect = $('select[name$="[countryCode]"]');

    countrySelect.on('change', (event) => {
      const select = $(event.currentTarget);
      const provinceContainer = select.parents('.field').next('div.province-container');

      const provinceSelectFieldName = select.attr('name').replace('country', 'province');
      const provinceInputFieldName = select.attr('name').replace('countryCode', 'provinceName');

      const provinceSelectFieldId = select.attr('id').replace('country', 'province');
      const provinceInputFieldId = select.attr('id').replace('countryCode', 'provinceName');

      const form = select.parents('form');

      if (select.val() === '' || select.val() == undefined) {
        provinceContainer.fadeOut('slow', () => {
          provinceContainer.html('');
        });

        return;
      }

      provinceContainer.attr('data-loading', true);
      form.addClass('loading');

      $.get(provinceContainer.attr('data-url'), { countryCode: select.val() }, (response) => {
        if (!response.content) {
          provinceContainer.fadeOut('slow', () => {
            provinceContainer.html('');

            provinceContainer.removeAttr('data-loading');
            form.removeClass('loading');
          });
        } else if (response.content.indexOf('select') !== -1) {
          provinceContainer.fadeOut('slow', () => {
            const provinceSelectValue = getProvinceInputValue((
              $(provinceContainer).find('select > option[selected$="selected"]').val()
            ));

            provinceContainer.html((
              response.content
                .replace('name="sylius_address_province"', `name="${provinceSelectFieldName}"${provinceSelectValue}`)
                .replace('id="sylius_address_province"', `id="${provinceSelectFieldId}"`)
                .replace('option value="" selected="selected"', 'option value=""')
                .replace(`option ${provinceSelectValue}`, `option ${provinceSelectValue}" selected="selected"`)
            ));
            provinceContainer.addClass('required');
            provinceContainer.removeAttr('data-loading');

            provinceContainer.fadeIn('fast', () => {
              form.removeClass('loading');
            });
          });
        } else {
          provinceContainer.fadeOut('slow', () => {
            const provinceInputValue = getProvinceInputValue($(provinceContainer).find('input').val());

            provinceContainer.html((
              response.content
                .replace('name="sylius_address_province"', `name="${provinceInputFieldName}"${provinceInputValue}`)
                .replace('id="sylius_address_province"', `id="${provinceInputFieldId}"`)
            ));

            provinceContainer.removeAttr('data-loading');

            provinceContainer.fadeIn('fast', () => {
              form.removeClass('loading');
            });
          });
        }
      });
    });

    if (countrySelect.val() !== '') {
      countrySelect.trigger('change');
    }

    if…
Record
GHSA-7prj-9ccr-hr3q
Weakness
CWE-79
Updated
2026-11-02
NVD 6.4

Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book.

Record
CVE-2024-29376
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 6.4

Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book.

Record
CVE-2024-29376
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVGHSA-7prj-9ccr-hr3q No score

Sylius has potential Cross Site Scripting vulnerability via the "Province" field in the Checkout and Address Book

Impact

There is a possibility to save XSS code in province field in the Checkout and Address Book and then execute it on these pages. The problem occurs when you open the address step page in the checkout or edit the address in the address book. This only affects the base UI Shop provided by Sylius.

Patches

The issue is fixed in versions: 1.9.12, 1.10.16, 1.11.17, 1.12.16, 1.13.1 and above.

Workarounds

  1. Create new file assets/shop/sylius-province-field.js:
// assets/shop/sylius-province-field.js

function sanitizeInput(input) {
  const div = document.createElement('div');
  div.textContent = input;
  return div.innerHTML; // Converts text content to plain HTML, stripping any scripts
}

const getProvinceInputValue = function getProvinceInputValue(valueSelector) {
  return valueSelector == undefined ? '' : `value="${sanitizeInput(valueSelector)}"`;
};

$.fn.extend({
  provinceField() {
    const countrySelect = $('select[name$="[countryCode]"]');

    countrySelect.on('change', (event) => {
      const select = $(event.currentTarget);
      const provinceContainer = select.parents('.field').next('div.province-container');

      const provinceSelectFieldName = select.attr('name').replace('country', 'province');
      const provinceInputFieldName = select.attr('name').replace('countryCode', 'provinceName');

      const provinceSelectFieldId = select.attr('id').replace('country', 'province');
      const provinceInputFieldId = select.attr('id').replace('countryCode', 'provinceName');

      const form = select.parents('form');

      if (select.val() === '' || select.val() == undefined) {
        provinceContainer.fadeOut('slow', () => {
          provinceContainer.html('');
        });

        return;
      }

      provinceContainer.attr('data-loading', true);
      form.addClass('loading');

      $.get(provinceContainer.attr('data-url'), { countryCode: select.val() }, (response) => {
        if (!response.content) {
          provinceContainer.fadeOut('slow', () => {
            provinceContainer.html('');

            provinceContainer.removeAttr('data-loading');
            form.removeClass('loading');
          });
        } else if (response.content.indexOf('select') !== -1) {
          provinceContainer.fadeOut('slow', () => {
            const provinceSelectValue = getProvinceInputValue((
              $(provinceContainer).find('select > option[selected$="selected"]').val()
            ));

            provinceContainer.html((
              response.content
                .replace('name="sylius_address_province"', `name="${provinceSelectFieldName}"${provinceSelectValue}`)
                .replace('id="sylius_address_province"', `id="${provinceSelectFieldId}"`)
                .replace('option value="" selected="selected"', 'option value=""')
                .replace(`option ${provinceSelectValue}`, `option ${provinceSelectValue}" selected="selected"`)
            ));
            provinceContainer.addClass('required');
            provinceContainer.removeAttr('data-loading');

            provinceContainer.fadeIn('fast', () => {
              form.removeClass('loading');
            });
          });
        } else {
          provinceContainer.fadeOut('slow', () => {
            const provinceInputValue = getProvinceInputValue($(provinceContainer).find('input').val());

            provinceContainer.html((
              response.content
                .replace('name="sylius_address_province"', `name="${provinceInputFieldName}"${provinceInputValue}`)
                .replace('id="sylius_address_province"', `id="${provinceInputFieldId}"`)
            ));

            provinceContainer.removeAttr('data-loading');

            provinceContainer.fadeIn('fast', () => {
              form.removeClass('loading');
            });
          });
        }
      });
    });

    if (countrySelect.val() !== '') {
      countrySelect.trigger('change');
    }

    if…
Record
GHSA-7prj-9ccr-hr3q
Weakness
CWE-79
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
sylius/sylius
Packagist
 1.12.0-alpha.1 up to 1.12.16
1.12.16
sylius/sylius
Packagist
 1.13.0-alpha.1 up to 1.13.1
1.13.1
sylius/sylius
Packagist
 before 1.9.12
1.9.12
sylius/sylius
Packagist
 1.10.0-alpha.1 up to 1.10.16
1.10.16
sylius/sylius
Packagist
 1.11.0-alpha.1 up to 1.11.17
1.11.17
sylius/sylius
Packagist
 before 1.9.12, plus listed versions
v0.1.0v0.10.0v0.11.0v0.12.0v0.13.0
Show 45 moreShow less
v0.14.0v0.15.0v0.16.0v0.17.0v0.18.0v0.19.0v0.2.0v0.3.0v0.5.0v0.6.0v0.7.0v0.8.0v0.9.0v1.0.0v1.0.0-alpha.1v1.0.0-alpha.2v1.0.0-beta.1v1.0.0-beta.2v1.0.0-beta.3v1.0.0-rc.1v1.0.0-rc.2v1.0.1v1.0.10v1.0.11v1.0.12v1.0.13v1.0.14v1.0.15v1.0.16v1.0.17v1.0.18v1.0.2v1.0.3v1.0.4v1.0.5v1.0.6v1.0.7v1.0.8v1.0.9v1.1.0v1.1.0-RCv1.1.1v1.1.10v1.1.11v1.1.12
1.9.12
sylius/sylius
Packagist
 1.10.0-alpha.1 up to 1.10.16, plus listed versions
v1.10.0v1.10.0-alpha.1v1.10.0-beta.1v1.10.0-rc.1v1.10.1
Show 14 moreShow less
v1.10.10v1.10.11v1.10.12v1.10.13v1.10.14v1.10.15v1.10.2v1.10.3v1.10.4v1.10.5v1.10.6v1.10.7v1.10.8v1.10.9
1.10.16
sylius/sylius
Packagist
 1.11.0-alpha.1 up to 1.11.17, plus listed versions
v1.11.0v1.11.0-alpha.1v1.11.0-alpha.2v1.11.0-beta.1v1.11.0-rc.1
Show 16 moreShow less
v1.11.1v1.11.10v1.11.11v1.11.12v1.11.13v1.11.14v1.11.15v1.11.16v1.11.2v1.11.3v1.11.4v1.11.5v1.11.6v1.11.7v1.11.8v1.11.9
1.11.17
sylius/sylius
Packagist
 1.12.0-alpha.1 up to 1.12.16, plus listed versions
v1.12.0v1.12.0-alpha.1v1.12.0-alpha.2v1.12.0-beta.1v1.12.0-rc.1
Show 15 moreShow less
v1.12.1v1.12.10v1.12.11v1.12.12v1.12.13v1.12.14v1.12.15v1.12.2v1.12.3v1.12.4v1.12.5v1.12.6v1.12.7v1.12.8v1.12.9
1.12.16
sylius/sylius
Packagist
 1.13.0-alpha.1 up to 1.13.1, plus listed versions
v1.13.0v1.13.0-alpha.1v1.13.0-alpha.2v1.13.0-beta.1v1.13.0-rc.1
1.13.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-29376 is a medium vulnerability (CVSS 6.4) in Sylius, published April 22, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in sylius/sylius 1.12.16.

References

This page doesn't list everything

Left out here: 138 versions and the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open