p PatchFirst

CVE-2022-24743

CVE-2022-24743 · Insufficient Session Expiration in Sylius

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue is fixed in versions 1.10.11 and 1.11.2. As a workaround, overwrite the `Sylius\Bundle\ApiBundle\CommandHandler\ResetPasswordHandler` class with code provided by the maintainers and register it in a container. More information about this workaround is available in the GitHub Security Advisory.

CVSS 7.1 · High · EPSS 1.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • sylius

    Versions
    • < 1.10.11: Affected
    • >= 1.11.0, < 1.11.2: Affected

    No fix published

  • sylius/sylius Packagist

    Versions
    • v1.10.0
    • v1.10.1
    • v1.10.10
    • v1.10.2
    • v1.10.3
    • v1.10.4
    • v1.10.5
    • v1.10.6
    • v1.10.7
    • v1.10.8
    • v1.10.9
    Affected ranges
    • ECOSYSTEM: ≥ 1.10.0, < 1.10.11

    Update to 1.10.11

  • sylius/sylius Packagist

    Versions
    • v1.11.0
    • v1.11.1
    Affected ranges
    • ECOSYSTEM: ≥ 1.11.0, < 1.11.2

    Update to 1.11.2

Original sources

Check your server →