VULNERABILITY INTELLIGENCE

CVE-2019-16768

CVSS score3.5 LOW

EPSS probability0.75%

CISA KEVNot currently listed

Published2019-12-05

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Description

In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation message with the exception details will be presented to the user when one will try to log into the shop. This has been patched in versions 1.3.14, 1.4.10, 1.5.7, and 1.6.3.

Weakness classification

CWE-209: Generation of Error Message Containing Sensitive Information

Primary references

security-advisories@github.com — Release Notes
security-advisories@github.com — Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes
af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Third Party Advisory