Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.2epss 0.3%
exploitation probability
0.3%top 84% of all CVEs
observed exploitation
nono source reports it
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains order as paid, causing financial loss.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
Sylius · SyliusReferences
https://github.com/Sylius/Syliushttps://github.com/Sylius/Sylius/commit/5813831f60f3a60b735a86a57c4b519626a3b75dhttps://github.com/Sylius/Sylius/pull/19214https://github.com/Sylius/Sylius/releases/tag/v2.2.9https://github.com/Sylius/Sylius/security/advisories/GHSA-2rv4-pjmm-7fxfhttps://www.vulncheck.com/advisories/sylius-2-x-before-2.1.16-and-2.2.9-arbitrary-payment-action-via-shop-api