Low

Ability to switch channels via GET parameter enabled in production environments

Disclosed: 31.01.2020
Updated: 11.10.2026 10:22

Impact

This vulnerability gives the ability to switch channels via the _channel_code GET parameter in production environments. This was meant to be enabled only when %kernel.debug% is set to true.

However, if no sylius_channel.debug is set explicitly in the configuration, the default value which is %kernel.debug% will be not resolved and cast to boolean, enabling this debug feature even if that parameter is set to false.

Patches

Patch has been provided for Sylius 1.3.x and newer - 1.3.16, 1.4.12, 1.5.9, 1.6.5. Versions older than 1.3 are not covered by our security support anymore.

Workarounds

Unsupported versions could be patched by adding the following configuration to run in production:

yaml

sylius_channel:
    debug: false

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Composer package	sylius/resource-bundle	>= 1.4.0, < 1.4.6, >= 1.5.0, < 1.5.1, >= 1.6.0, < 1.6.3, >= 1.0.0, < 1.3.13	1.4.6, 1.5.1, 1.6.3, 1.3.13
Composer package	sylius/sylius	< 1.3.16, >= 1.4.0, < 1.4.12, >= 1.5, < 1.5.9, >= 1.6.0, < 1.6.5	1.3.16, 1.4.12, 1.5.9, 1.6.5

References

CVSS score 4.4/10

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-200, CWE-444
Platform: Composer
Package: sylius/resource-bundle, sylius/sylius
Disclosed: 31.01.2020
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-8vp7-j5cj-vvm2 - CC BY 4.0

OSV / GitHub Advisory Database - GHSA-prg5-hg25-8grq - CC BY 4.0

Vulnerability history: sylius/resource-bundle

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 4
First → latest: 01.2020 05.2024
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Critical 1
High 1
Medium 1
Low 1

Disclosures per year

2020: 3
2021: 0
2022: 0
2023: 0
2024: 1
2025: 0
2026: 0

29.05.2024

Sylius Resource Bundle Cross-Site Request Forgery vulnerability

Medium · 6.5 ghsa-65v7-wg35-2qpm >= 1.0.0, < 1.0.17, >= 1.1.0, < 1.1.9, >= 1.2.0, < 1.2.2 1.0.17, 1.1.9, 1.2.2
19.08.2020

Remote Code Execution in SyliusResourceBundle

High · 7.7 CVE-2020-15143 >= 1.4.0, < 1.4.7, >= 1.5.0, < 1.5.2, >= 1.6.0, < 1.6.4, >= 1.0.0, < 1.3.14 1.4.7, 1.5.2, 1.6.4, 1.3.14
19.08.2020

Remote Code Execution in SyliusResourceBundle

Critical · 9.6 CVE-2020-15146 >= 1.4.0, < 1.4.7, >= 1.5.0, < 1.5.2, >= 1.6.0, < 1.6.4, >= 1.0.0, < 1.3.14 1.4.7, 1.5.2, 1.6.4, 1.3.14
31.01.2020

Ability to switch channels via GET parameter enabled in production environments this entry

Low · 4.4 CVE-2020-5218 >= 1.4.0, < 1.4.6, >= 1.5.0, < 1.5.1, >= 1.6.0, < 1.6.3, >= 1.0.0, < 1.3.13 1.4.6, 1.5.1, 1.6.3, 1.3.13

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application