Remote Code Execution in SyliusResourceBundle
CVE-2020-15143

7.7HIGH

Key Information:

Vendor

Sylius

Status
Syliusresourcebundle
Vendor
CVE Published:
20 August 2020

What is CVE-2020-15143?

In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.

Affected Version(s)

SyliusResourceBundle < 1.3.14 < 1.3.14

SyliusResourceBundle >= 1.4.0 , < 1.4.7 < 1.4.0 , 1.4.7

SyliusResourceBundle >= 1.5.0, < 1.5.2 < 1.5.0, 1.5.2

References

https://github.com/Sylius/SyliusResourceBundle/security/a...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.