CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-32720 – List of order ids, number, items total and token value exposed for unauthorized uses via new API
https://notcve.org/view.php?id=CVE-2021-32720
Sylius is an Open Source eCommerce platform on top of Symfony. In versions of Sylius prior to 1.9.5 and 1.10.0-RC.1, part of the details (order ID, order number, items total, and token value) of all placed orders were exposed to unauthorized users. If exploited properly, a few additional information like the number of items in the cart and the date of the shipping may be fetched as well. This data seems to not be crucial nor is personal data, however, could be used for sociotechnical attacks or may expose a few details about shop condition to the third parties. The data possible to aggregate are the number of processed orders or their value in the moment of time. • https://github.com/Sylius/Sylius/releases/tag/v1.9.5 https://github.com/Sylius/Sylius/security/advisories/GHSA-rpxh-vg2x-526v • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-15245 – Email verification bypass in Sylius
https://notcve.org/view.php?id=CVE-2020-15245
In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one). The issue has been patched in Sylius 1.6.9, 1.7.9 and 1.8.3. As a workaround, you may resolve this issue on your own by creating a custom event listener, which will listen to the sylius.customer.pre_update event. • https://github.com/Sylius/Sylius/commit/60636d711a4011e8694d10d201b53632c7e8ecaf https://github.com/Sylius/Sylius/security/advisories/GHSA-6gw4-x63h-5499 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-862: Missing Authorization •
CVSS: 4.4EPSS: 0%CPEs: 4EXPL: 0CVE-2020-5218 – Ability in Sylius to switch channels via GET parameter enabled in production environments
https://notcve.org/view.php?id=CVE-2020-5218
Affected versions of Sylius give attackers the ability to switch channels via the _channel_code GET parameter in production environments. This was meant to be enabled only when kernel.debug is set to true. However, if no sylius_channel.debug is set explicitly in the configuration, the default value which is kernel.debug will be not resolved and cast to boolean, enabling this debug feature even if that parameter is set to false. Patch has been provided for Sylius 1.3.x and newer - 1.3.16, 1.4.12, 1.5.9, 1.6.5. Versions older than 1.3 are not covered by our security support anymore. • https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/resource-bundle/CVE-2020-5220.yaml https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-8vp7-j5cj-vvm2 • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 4.8EPSS: 0%CPEs: 11EXPL: 0CVE-2019-12186
https://notcve.org/view.php?id=CVE-2019-12186
An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the "string" field type. The contents are an object, with malicious code returned by the __toString() method of that object. Se descubrió un problema en los productos Sylius. Una perdida de saneamiento de la entrada en sylius/sylius versiones 1.0.x hasta 1.0.18, 1.1.x hasta 1.1.17, 1.2.x hasta 1.2.16, 1.3.x hasta 1.3.11 y 1.4.x hasta 1.4.3 y sylius/grid versiones 1.0.x hasta 1.0.18, versiones 1.1.x hasta 1.1.18, versiones 1.2.x hasta 1.2.17, versiones 1.3.x hasta 1.3.12, versiones 1.4.x hasta 1.4.4 y versión 1.5.0, permite a un atacante (un administrador en el caso de sylius/sylius) llevar a cabo un ataque de tipo XSS mediante una inyección de código malicioso en un campo que se muestra en una cuadrícula con el tipo de campo "string". • https://sylius.com/blog/cve-2019-12186 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2019-16768 – Internal exception message exposure for login action in Sylius
https://notcve.org/view.php?id=CVE-2019-16768
In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation message with the exception details will be presented to the user when one will try to log into the shop. This has been patched in versions 1.3.14, 1.4.10, 1.5.7, and 1.6.3. Unos mensajes de excepción de las excepciones internas (como la excepción de la base de datos) están empaquetados por \Symfony\Component\Security\Core\Exception\AuthenticationServiceException y se propagan por medio del sistema a la Interfaz de Usuario. • https://github.com/Sylius/Sylius/commit/be245302dfc594d8690fe50dd47631d186aa945f https://github.com/Sylius/Sylius/security/advisories/GHSA-3r8j-pmch-5j2h • CWE-209: Generation of Error Message Containing Sensitive Information •