Vulnerability · Published Jan 27, 2020 · Assigned by GitHub_M
CVE-2020-5220Ability to expose data in Sylius by using an unintended serialisation group
Medium 4.4
In plain English
A medium-severity security flaw in SyliusResourceBundle from Sylius. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's controller is affected. The vulnerable versions are: <1.3 || >=1.3.0 <=1.3.12 || >=1.4.0 <=1.4.5 || >=1.5.0 <=1.5.0 || >=1.6.0 <=1.6.2. The patch is provided for Sylius ResourceBundle 1.3.13, 1.4.6, 1.5.1 and 1.6.3, but not for any versions below 1.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | sylius/resource-bundle | 1.4.6 | GHSA-8vp7-j5cj-vvm2 |
| Packagist | sylius/resource-bundle | 1.5.1 | GHSA-8vp7-j5cj-vvm2 |
| Packagist | sylius/resource-bundle | 1.6.3 | GHSA-8vp7-j5cj-vvm2 |
| Packagist | sylius/resource-bundle | 1.3.13 | GHSA-8vp7-j5cj-vvm2 |
| Packagist | sylius/sylius | 1.4.4 | GHSA-8vp7-j5cj-vvm2 |
| Packagist | sylius/sylius | 1.6.5 | GHSA-prg5-hg25-8grq |
| Packagist | sylius/sylius | 1.3.16 | GHSA-prg5-hg25-8grq |
| Packagist | sylius/sylius | 1.4.12 | GHSA-prg5-hg25-8grq |
| Packagist | sylius/sylius | 1.5.9 | GHSA-prg5-hg25-8grq |
| Packagist | sylius/sylius | 1.3.12 | GHSA-8vp7-j5cj-vvm2 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Sylius | SyliusResourceBundle | < 1.3.13>= 1.4.0, < 1.4.6>= 1.5.0, < 1.5.1>= 1.6.0, < 1.6.3 |
Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N