Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.3%
probabilidade de exploração
0.3%top 84% das CVEs
exploração observada
nãonenhuma fonte reporta
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains order as paid, causing financial loss.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Sylius · SyliusReferências
https://github.com/Sylius/Syliushttps://github.com/Sylius/Sylius/commit/5813831f60f3a60b735a86a57c4b519626a3b75dhttps://github.com/Sylius/Sylius/pull/19214https://github.com/Sylius/Sylius/releases/tag/v2.2.9https://github.com/Sylius/Sylius/security/advisories/GHSA-2rv4-pjmm-7fxfhttps://www.vulncheck.com/advisories/sylius-2-x-before-2.1.16-and-2.2.9-arbitrary-payment-action-via-shop-api