CVE-2020-15146criticalCWE-74

CVE-2020-15146: fallo crítico en SyliusResourceBundle

Remote Code Execution in SyliusResourceBundle

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear SyliusResourceBundle+ Monitorear sylius/resource-bundle

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.6epss 2.1%
In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Productos afectados
Sylius · SyliusResourceBundle
CVEs relacionadas — SyliusResourceBundle

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-15143HIGHRemote Code Execution in SyliusResourceBundleEPSS 1.9%CVE-2020-5220MEDIUMAbility to expose data in Sylius by using an unintended serialisation groupEPSS 0.7%