CVE-2020-5218 - Ability in Sylius to switch channels via GET parameter enabled in production environments

Back Back to CVE browser

MEDIUM

Ability in Sylius to switch channels via GET parameter enabled in production environments

Published Jan 27, 2020

4.4

MEDIUM

CVSS 3.1

EPSS 0.60%

Description

Affected versions of Sylius give attackers the ability to switch channels via the _channel_code GET parameter in production environments. This was meant to be enabled only when kernel.debug is set to true. However, if no sylius_channel.debug is set explicitly in the configuration, the default value which is kernel.debug will be not resolved and cast to boolean, enabling this debug feature even if that parameter is set to false. Patch has been provided for Sylius 1.3.x and newer - 1.3.16, 1.4.12, 1.5.9, 1.6.5. Versions older than 1.3 are not covered by our security support anymore.

Affected products

Vendor Sylius Product Sylius Default
n/a
- Version
  < 1.3.13
  Status
  affected
  Constraints
  -
- Version
  >= 1.4.0, < 1.4.6
  Status
  affected
  Constraints
  -
- Version
  >= 1.5.0, < 1.5.1
  Status
  affected
  Constraints
  -
- Version
  >= 1.6.0, < 1.6.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Sylius

n/a

Version	Status	Constraints
< 1.3.13	affected	-
>= 1.4.0, < 1.4.6	affected	-
>= 1.5.0, < 1.5.1	affected	-
>= 1.6.0, < 1.6.3	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-444

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0273
Advisory
https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/resource-bundle/CVE-2020-5220.yaml
x_refsource_MISCThird Party Advisory
https://github.com/Sylius/Sylius/security/advisories/GHSA-prg5-hg25-8grq
https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-8vp7-j5cj-vvm2
x_refsource_CONFIRMPatchThird Party Advisory
https://github.com/advisories/GHSA-prg5-hg25-8grq
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-5218

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0273		Advisory
https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/resource-bundle/CVE-2020-5220.yaml		x_refsource_MISCThird Party Advisory
https://github.com/Sylius/Sylius/security/advisories/GHSA-prg5-hg25-8grq
https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-8vp7-j5cj-vvm2		x_refsource_CONFIRMPatchThird Party Advisory
https://github.com/advisories/GHSA-prg5-hg25-8grq		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-5218