Remote Code Execution in SyliusResourceBundle
CVE-2020-15146

9.6CRITICAL

Key Information:

Vendor

Sylius

Status
Syliusresourcebundle
Vendor
CVE Published:
20 August 2020

What is CVE-2020-15146?

In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.

Affected Version(s)

SyliusResourceBundle < 1.3.14 < 1.3.14

SyliusResourceBundle >= 1.4.0 , < 1.4.7 < 1.4.0 , 1.4.7

SyliusResourceBundle >= 1.5.0, < 1.5.2 < 1.5.0, 1.5.2

References

https://github.com/Sylius/SyliusResourceBundle/security/a...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.