by Kastro
Paper/Archive/CVE-2020-15146

CVE-2020-15146

Sylius SyliusResourceBundle — Remote Code Execution in SyliusResourceBundle

EPSS 2%CVSS 9.6
critical.is priorityof 100
45
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 82.1.821 × 2016.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.

Affected

ProductAffectedFixed inSource
SyliusResourceBundle< 1.3.14–CNA
SyliusResourceBundle>= 1.4.0 , < 1.4.7–CNA
SyliusResourceBundle>= 1.5.0, < 1.5.2–CNA
SyliusResourceBundle>= 1.6.0, < 1.6.4–CNA

Scores by source

GitHub_M (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

References

refgithub.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-h6m7-j4h3-9rf5