CVE-2020-15143

In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.
Configurations

Configuration 1

cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:*

Information

Published : 2020-08-20 01:17

Updated : 2021-11-18 06:33


NVD link : CVE-2020-15143

Mitre link : CVE-2020-15143

Products Affected
No products.
CWE
CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')