~ / search / GHSA-prg5-hg25-8grq

GHSA-prg5-hg25-8grq

Ability to switch channels via GET parameter enabled in production environments

Source: GitHub Advisory Database (reviewed) Low CVE-2020-5218

Packages

EcosystemPackageAffectedFixed in
Packagist sylius/sylius < 1.3.16 1.3.16
Packagist sylius/sylius >= 1.4.0, < 1.4.12 1.4.12
Packagist sylius/sylius >= 1.5, < 1.5.9 1.5.9
Packagist sylius/sylius >= 1.6.0, < 1.6.5 1.6.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact This vulnerability gives the ability to switch channels via the `_channel_code` GET parameter in production environments. This was meant to be enabled only when `%kernel.debug%` is set to true. However, if no `sylius_channel.debug` is set explicitly in the configuration, the default value which is `%kernel.debug%` will be not resolved and cast to boolean, enabling this debug feature even if that parameter is set to false. ### Patches Patch has been provided for Sylius 1.3.x and newer - **1.3.16, 1.4.12, 1.5.9, 1.6.5**. Versions older than 1.3 are not covered by our security support anymore. ### Workarounds Unsupported versions could be patched by adding the following configuration to run in production: ```yaml sylius_channel: debug: false ```

References

External links from the advisory. They lead to third-party sites.