CVE-2020-15143

In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:04

Type Values Removed Values Added
CVSS v2 : 6.5
v3 : 8.8
v2 : 6.5
v3 : 7.7
References () https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-p4pj-9g59-4ppvĀ - Exploit, Mitigation, Third Party Advisory () https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-p4pj-9g59-4ppvĀ - Exploit, Mitigation, Third Party Advisory

Information

Published : 2020-08-20 01:17

Updated : 2024-11-21 05:04


NVD link : CVE-2020-15143

Mitre link : CVE-2020-15143

CVE.ORG link : CVE-2020-15143


JSON object : View

Products Affected

sylius

  • syliusresourcebundle
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')