tocsin

CVE-2020-5218

3 advisories.

Packagist/sylius/resource-bundle CVE-2020-5218, CVE-2020-5220: medium 4.4, EPSS 0.60%

Ability to expose data in Sylius by using an unintended serialisation group

Action: Upgrade sylius/resource-bundle to 1.3.13 or later.

composer require sylius/resource-bundle:1.4.6
composer require sylius/resource-bundle:1.5.1
composer require sylius/resource-bundle:1.6.3
composer require sylius/resource-bundle:1.3.13

Affected

introducedfixedlast affected
1.4.01.4.6-
1.5.01.5.1-
1.6.01.6.3-
1.0.01.3.13-

Fixed versions

1.4.61.5.11.6.31.3.13

Sources

CVE-2020-5218, CVE-2020-5220 · published · modified · JSON

Packagist/sylius/sylius CVE-2020-5218, CVE-2020-5220: medium 4.4, EPSS 0.60%

Ability to expose data in Sylius by using an unintended serialisation group

Action: Upgrade sylius/sylius to 1.3.12 or later.

composer require sylius/sylius:1.3.12
composer require sylius/sylius:1.4.4

Affected

introducedfixedlast affected
01.3.12-
1.4.01.4.4-

Fixed versions

1.3.121.4.4

Sources

CVE-2020-5218, CVE-2020-5220 · published · modified · JSON

Packagist/sylius/sylius CVE-2020-5218, CVE-2020-5220: medium 4.4, EPSS 0.60%

Ability to switch channels via GET parameter enabled in production environments

Action: Upgrade sylius/sylius to 1.3.16 or later.

composer require sylius/sylius:1.3.16
composer require sylius/sylius:1.4.12
composer require sylius/sylius:1.5.9
composer require sylius/sylius:1.6.5

Affected

introducedfixedlast affected
01.3.16-
1.4.01.4.12-
1.51.5.9-
1.6.01.6.5-

Fixed versions

1.3.161.4.121.5.91.6.5

Sources

CVE-2020-5218, CVE-2020-5220 · published · modified · JSON