p PatchFirst

CVE-2020-15146

CVE-2020-15146 · Remote Code Execution in SyliusResourceBundle

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.

CVSS 9.6 · Critical · EPSS 2.1% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • syliusresourcebundle

    Versions
    • < 1.3.14: Affected
    • >= 1.4.0 , < 1.4.7: Affected
    • >= 1.5.0, < 1.5.2: Affected
    • >= 1.6.0, < 1.6.4: Affected

    No fix published

  • sylius/resource-bundle Packagist

    Versions
    • v1.4.0
    • v1.4.1
    • v1.4.2
    • v1.4.3
    • v1.4.4
    • v1.4.5
    • v1.4.6
    Affected ranges
    • ECOSYSTEM: ≥ 1.4.0, < 1.4.7

    Update to 1.4.7

  • sylius/resource-bundle Packagist

    Versions
    • v1.5.0
    • v1.5.1
    Affected ranges
    • ECOSYSTEM: ≥ 1.5.0, < 1.5.2

    Update to 1.5.2

  • sylius/resource-bundle Packagist

    Versions
    • v1.6.0
    • v1.6.1
    • v1.6.2
    • v1.6.3
    Affected ranges
    • ECOSYSTEM: ≥ 1.6.0, < 1.6.4

    Update to 1.6.4

  • sylius/resource-bundle Packagist

    Versions
    • v1.0.0
    • v1.0.1
    • v1.0.10
    • v1.0.11
    • v1.0.12
    • v1.0.13
    • v1.0.14
    • v1.0.15
    • v1.0.16
    • v1.0.17
    • v1.0.18
    • v1.0.2
    • v1.0.3
    • v1.0.4
    • v1.0.5
    • v1.0.6
    • v1.0.7
    • v1.0.8
    • v1.0.9
    • v1.1.0
    • v1.1.0-RC
    • v1.1.1
    • v1.1.10
    • v1.1.11
    • v1.1.12
    • v1.1.13
    • v1.1.14
    • v1.1.15
    • v1.1.17
    • v1.1.18
    • v1.1.2
    • v1.1.3
    • v1.1.4
    • v1.1.5
    • v1.1.6
    • v1.1.7
    • v1.1.8
    • v1.1.9
    • v1.2.0
    • v1.2.0-BETA
    • v1.2.0-RC
    • v1.2.1
    • v1.2.10
    • v1.2.11
    • v1.2.12
    • v1.2.13
    • v1.2.14
    • v1.2.15
    • v1.2.16
    • v1.2.17
    • v1.2.2
    • v1.2.3
    • v1.2.4
    • v1.2.5
    • v1.2.6
    • v1.2.7
    • v1.2.8
    • v1.2.9
    • v1.3.0
    • v1.3.0-BETA
    • v1.3.1
    • v1.3.10
    • v1.3.11
    • v1.3.12
    • v1.3.13
    • v1.3.2
    • v1.3.3
    • v1.3.4
    • v1.3.5
    • v1.3.6
    • v1.3.7
    • v1.3.8
    • v1.3.9
    Affected ranges
    • ECOSYSTEM: ≥ 1.0.0, < 1.3.14

    Update to 1.3.14

Original sources

Check your server →