Skip to main content

Generation of Error Message Containing Sensitive Information

CVE-2019-16768

Medium
4.3/10

Summary

In Sylius before 1.3.14, 1.4.x before 1.4.10, 1.5.x before 1.5.7 and 1.6.x before 1.6.3, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation message with the exception details will be presented to the user when one will try to log into the shop.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • LOW
  • NONE

CWE-209 - Generation of Error Message Containing Sensitive Information

The software generates an error message that includes sensitive information about its environment, users, or associated data.

References

Advisory Timeline

  • Published