---
title: "CVE-2024-34349"
date: "2024-05-10T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cve-2024-34349/"
---

# CVE-2024-34349

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

Fixed: May 9, 2024

CVE-2024-34349  **Published:** May 10, 2024

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')  4.8 Medium Severity cross-site injection javascript php scripting XSS

MT Mário Teixeira  Reported by Checkmarx Zero

Details Overview

## Summary

The sylius package is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in various components of the Admin panel via `Name` field.

## Product

This vulnerability affects `sylius/sylius` and `sylius/admin-bundle` versions prior to 1.12.16 and 1.13.1.

## Impact

The vulnerability allows to inject JavaScript code that will be executed by other administrators, which could lead to serious implications like Account Takeover.

## Steps to reproduce

1. On the Admin panel, create a new element. A `Taxon` for instance.
2. Insert a script in the `Name` field in any of the languages:

```javascript
<script>alert('XSS')</script>
```

3. Visit any page where the field `Name` is being rendered.

### Expected result:

A pop-up appears on the screen with the message `XSS`.

## Remediation

A [fix was merged](https://github.com/Sylius/Sylius/commit/d4812f9c14c7b2acc1f2f64cff363533e4c77b41) to sanitize the input to prevent malicious code from being executed.

## Credit

This issue was discovered and reported by Checkmarx AppSec Analyst [Mário Teixeira](https://www.linkedin.com/in/marioleitao-teixeira/).

## Resources

1. [Advisory](https://github.com/advisories/GHSA-v2f9-rv6w-vw8r)
2. [Pull Request](https://github.com/Sylius/Sylius/pull/16241)
3. [Commit](https://github.com/Sylius/Sylius/commit/d4812f9c14c7b2acc1f2f64cff363533e4c77b41)
4. [Release Note](https://github.com/Sylius/Sylius/releases/tag/v1.13.1)

0  Medium Severity CVSS v3.1 Score

   4.8

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: Required
- Scope: Changed
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

Advisory Timeline1. Discovered Mar 6, 2024 Discovered by the Checkmarx Research Group.
2. Disclosed Mar 7, 2024 The vulnerability was privately disclosed to the maintainer.
3. Fixed May 9, 2024 The vulnerability was fixed with the commit d4812f9c.

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)