PT-2022-16846 · Sylius · Sylius

Lchrusciel · Published 2022-03-14 · Updated 2022-03-22 · CVE-2022-24743

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 1.10.11 and 1.11.2

Description The reset password token was not set to null after the password was changed, allowing the same token to be used several times. This could result in a leak of the existing token and unauthorized password change.

Recommendations For versions prior to 1.10.11 and 1.11.2, update to version 1.10.11 or 1.11.2 to fix the issue. As a temporary workaround, overwrite the SyliusBundleApiBundleCommandHandlerResetPasswordHandler class with the provided code and register it in a container.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2022-24743

GHSA-MF3V-F2QQ-PF9G

Affected Products

Sylius

References · 9

• 🔥 https://github.com/Sylius/Sylius/security/advisories/GHSA-mf3v-f2qq-pf9g · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24743.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-24743 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24743 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mf3v-f2qq-pf9g · Vendor Advisory
• https://github.com/Sylius/Sylius · Note
• https://github.com/Sylius/Sylius/releases/tag/v1.10.11 · Note
• https://github.com/Sylius/Sylius/releases/tag/v1.11.2 · Note
• https://t.me/cibsecurity/38906 · Telegram Post