CVE-2020-5220: Inconsistent Interpretation of HTTP Requests

Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's...

PT-2020-18314

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 1.3.13 Sylius versions 1.3.0 through 1.3.12 Sylius versions 1.4.0 through 1.4.5 Sylius versions 1.5.0 Sylius versions 1.6.0 through 1.6.2 Description The issue allows attackers to switch channels via the channel code G...

CVE-2020-5220: Ability to define unintended serialisation groups via HTTP header which might lead to data exposure

Impact ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's...