Ability to switch channels via GET parameter enabled in production environments
Impact
This vulnerability gives the ability to switch channels via the _channel_code GET parameter in production environments. This was meant to be enabled only when %kernel.debug% is set to true.
However, if no sylius_channel.debug is set explicitly in the configuration, the default value which is %kernel.debug% will be not resolved and cast to boolean, enabling this debug feature even if that parameter is set to false.
Patches
Patch has been provided for Sylius 1.3.x and newer - 1.3.16, 1.4.12, 1.5.9, 1.6.5. Versions older than 1.3 are not covered by our security support anymore.
Workarounds
Unsupported versions could be patched by adding the following configuration to run in production:
sylius_channel:
debug: falseSoftware afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | sylius/resource-bundle | >= 1.4.0, < 1.4.6, >= 1.5.0, < 1.5.1, >= 1.6.0, < 1.6.3, >= 1.0.0, < 1.3.13 | 1.4.6, 1.5.1, 1.6.3, 1.3.13 |
| Paquete de Composer | sylius/sylius | < 1.3.16, >= 1.4.0, < 1.4.12, >= 1.5, < 1.5.9, >= 1.6.0, < 1.6.5 | 1.3.16, 1.4.12, 1.5.9, 1.6.5 |
Referencias
- https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-8vp7-j5cj-vvm2
- https://nvd.nist.gov/vuln/detail/CVE-2020-5220
- https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/resource-bundle/CVE-2020-5220.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/sylius/CVE-2020-5220.yaml
- https://github.com/Sylius/Sylius/security/advisories/GHSA-prg5-hg25-8grq
- https://nvd.nist.gov/vuln/detail/CVE-2020-5218
- Vector CVSS
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N- Debilidad (CWE)
CWE-200, CWE-444- Plataforma
- Composer
- Paquete
sylius/resource-bundle, sylius/sylius- Publicada
- 31.01.2020
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-8vp7-j5cj-vvm2 - CC BY 4.0
OSV / GitHub Advisory Database - GHSA-prg5-hg25-8grq - CC BY 4.0
Historial de vulnerabilidades: sylius/resource-bundle
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 4
- Primera → última
- 01.2020 05.2024
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 1
- Alta 1
- Media 1
- Baja 1
Divulgaciones por año
- 2020: 3
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 1
- 2025: 0
- 2026: 0
-
Ability to switch channels via GET parameter enabled in production environments esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.