CVE-2020-15146

In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:04

Type Values Removed Values Added
References () https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-h6m7-j4h3-9rf5 - Exploit, Mitigation, Third Party Advisory () https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-h6m7-j4h3-9rf5 - Exploit, Mitigation, Third Party Advisory
CVSS v2 : 6.5
v3 : 8.8
v2 : 6.5
v3 : 9.6

Information

Published : 2020-08-20 01:17

Updated : 2024-11-21 05:04


NVD link : CVE-2020-15146

Mitre link : CVE-2020-15146

CVE.ORG link : CVE-2020-15146


JSON object : View

Products Affected

sylius

  • syliusresourcebundle
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')