PT-2024-28954 · Sylius · Sylius

Published 2024-07-17 · Updated 2024-07-18 · CVE-2024-40633

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 1.12.19 Sylius versions prior to 1.13.4

Description A security issue was discovered in the "/api/v2/shop/adjustments/{id}" endpoint, which retrieves order adjustments based on incremental integer IDs. The issue allows an attacker to enumerate valid adjustment IDs and retrieve order tokens. Using these tokens, an attacker can access guest customer order details, including sensitive guest customer information.

Recommendations For Sylius versions prior to 1.12.19, upgrade to version 1.12.19 or above. For Sylius versions prior to 1.13.4, upgrade to version 1.13.4 or above. As a temporary workaround for users unable to upgrade, alter the configuration to mitigate this issue by creating a "config/api platform/Adjustment.yaml" file with the specified settings or by modifying the "config/api platform/Adjustment.xml" file to change the "shop get" operation.

Exploit

Fix

IDOR

Information Disclosure

Weakness Enumeration

CWE-639

CWE-200

Related Identifiers

CVE-2024-40633

GHSA-55RF-8Q29-4G43

Affected Products

Sylius

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40633.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-40633 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40633 · Security Note
• https://osv.dev/vulnerability/GHSA-55rf-8q29-4g43 · Vendor Advisory
• https://github.com/Sylius/Sylius · Note
• https://github.com/Sylius/Sylius/security/advisories/GHSA-55rf-8q29-4g43 · Note
• https://github.com/Sylius/Sylius/commit/d833b2871caa3b8d1f0a8207378bb778f0b90464 · Note
• https://t.me/cvenotify/86558 · Telegram Post
• https://t.me/cvedetector/1112 · Telegram Post