CVE-2020-15146criticalCWE-74

CVE-2020-15146: critical vulnerability in SyliusResourceBundle

Remote Code Execution in SyliusResourceBundle

Published · Updated

Follow this CVE+ Monitor SyliusResourceBundle+ Monitor sylius/resource-bundle

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.6epss 2.1%
In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected products
Sylius · SyliusResourceBundle
Related CVEs — SyliusResourceBundle

In the same product, most dangerous first.

CVE-2020-15143HIGHRemote Code Execution in SyliusResourceBundleEPSS 1.9%CVE-2020-5220MEDIUMAbility to expose data in Sylius by using an unintended serialisation groupEPSS 0.7%