Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface with a different interface provided by the attacker. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. Every response from app should have an X-Frame-Options header set to: ``sameorigin``. To achieve that, add a new `subscriber` in the app.
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
| Link | Tags |
|---|---|
| https://github.com/Sylius/Sylius/security/advisories/GHSA-4jp3-q2qm-9fmw | third party advisory mitigation |
| https://github.com/Sylius/Sylius/releases/tag/v1.10.11 | third party advisory release notes |
| https://github.com/Sylius/Sylius/releases/tag/v1.11.2 | third party advisory release notes |
| https://github.com/Sylius/Sylius/releases/tag/v1.9.10 | third party advisory release notes |