CVE-2020-5220
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.9 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
31.1%
Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle’s controller is affected. The vulnerable versions are: <1.3 || >=1.3.0 <=1.3.12 || >=1.4.0 <=1.4.5 || >=1.5.0 <=1.5.0 || >=1.6.0 <=1.6.2. The patch is provided for Sylius ResourceBundle 1.3.13, 1.4.6, 1.5.1 and 1.6.3, but not for any versions below 1.3.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| sylius | syliusresourcebundle | * | cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:* |
| sylius | syliusresourcebundle | * | cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:* |
| sylius | syliusresourcebundle | * | cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:* |
| sylius | syliusresourcebundle | * | cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:* |
CNA Affected
[
{
"product": "SyliusResourceBundle",
"vendor": "Sylius",
"versions": [
{
"status": "affected",
"version": "< 1.3.13"
},
{
"status": "affected",
"version": ">= 1.4.0, < 1.4.6"
},
{
"status": "affected",
"version": ">= 1.5.0, < 1.5.1"
},
{
"status": "affected",
"version": ">= 1.6.0, < 1.6.3"
}
]
}
]Related
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.9 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
31.1%