CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-15245 – Email verification bypass in Sylius
https://notcve.org/view.php?id=CVE-2020-15245
In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one). The issue has been patched in Sylius 1.6.9, 1.7.9 and 1.8.3. As a workaround, you may resolve this issue on your own by creating a custom event listener, which will listen to the sylius.customer.pre_update event. • https://github.com/Sylius/Sylius/commit/60636d711a4011e8694d10d201b53632c7e8ecaf https://github.com/Sylius/Sylius/security/advisories/GHSA-6gw4-x63h-5499 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-862: Missing Authorization •
CVSS: 4.4EPSS: 0%CPEs: 4EXPL: 0CVE-2020-5218 – Ability in Sylius to switch channels via GET parameter enabled in production environments
https://notcve.org/view.php?id=CVE-2020-5218
Affected versions of Sylius give attackers the ability to switch channels via the _channel_code GET parameter in production environments. This was meant to be enabled only when kernel.debug is set to true. However, if no sylius_channel.debug is set explicitly in the configuration, the default value which is kernel.debug will be not resolved and cast to boolean, enabling this debug feature even if that parameter is set to false. Patch has been provided for Sylius 1.3.x and newer - 1.3.16, 1.4.12, 1.5.9, 1.6.5. Versions older than 1.3 are not covered by our security support anymore. • https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/resource-bundle/CVE-2020-5220.yaml https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-8vp7-j5cj-vvm2 • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2019-16768 – Internal exception message exposure for login action in Sylius
https://notcve.org/view.php?id=CVE-2019-16768
In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation message with the exception details will be presented to the user when one will try to log into the shop. This has been patched in versions 1.3.14, 1.4.10, 1.5.7, and 1.6.3. Unos mensajes de excepción de las excepciones internas (como la excepción de la base de datos) están empaquetados por \Symfony\Component\Security\Core\Exception\AuthenticationServiceException y se propagan por medio del sistema a la Interfaz de Usuario. • https://github.com/Sylius/Sylius/commit/be245302dfc594d8690fe50dd47631d186aa945f https://github.com/Sylius/Sylius/security/advisories/GHSA-3r8j-pmch-5j2h • CWE-209: Generation of Error Message Containing Sensitive Information •