PT-2020-14310 · Sylius · Sylius

Decemvre + 1 · Published 2020-10-19 · Updated 2021-11-18 · CVE-2020-15245

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 1.6.9 Sylius versions prior to 1.7.9 Sylius versions prior to 1.8.3

Description The issue allows a user to register in a shop by email, verify it, change it to a different email, and stay verified and enabled. This may lead to having accounts addressed to totally different emails that were verified. Note that this does not allow taking over any existing account.

Recommendations For Sylius versions prior to 1.6.9, update to version 1.6.9 or newer. For Sylius versions prior to 1.7.9, update to version 1.7.9 or newer. For Sylius versions prior to 1.8.3, update to version 1.8.3 or newer. As a temporary workaround for versions that cannot be updated, create a custom event listener that listens to the sylius.customer.pre update event to determine if the email has been changed by checking if the customer email and user username are different, and adjust the logic accordingly, considering the email changing behavior for administrators.

Exploit

Fix

Missing Authorization

XSS

Weakness Enumeration

CWE-862

CWE-79

Related Identifiers

CVE-2020-15245

GHSA-6GW4-X63H-5499

Affected Products

Sylius

References · 7

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/sylius/CVE-2020-15245.yaml · Exploit
• https://github.com/Sylius/Sylius/commit/60636d711a4011e8694d10d201b53632c7e8ecaf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15245 · Security Note
• https://osv.dev/vulnerability/GHSA-6gw4-x63h-5499 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15245 · Vendor Advisory
• https://github.com/Sylius/Sylius · Note
• https://github.com/Sylius/Sylius/security/advisories/GHSA-6gw4-x63h-5499 · Note