CVE-2020-5220

Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's controller is affected. The vulnerable versions are: <1.3 || >=1.3.0 <=1.3.12 || >=1.4.0 <=1.4.5 || >=1.5.0 <=1.5.0 || >=1.6.0 <=1.6.2. The patch is provided for Sylius ResourceBundle 1.3.13, 1.4.6, 1.5.1 and 1.6.3, but not for any versions below 1.3.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/resource-bundle/CVE-2020-5220.yaml	Third Party Advisory
https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-8vp7-j5cj-vvm2	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sylius:syliusresourcebundle::::::::
	cpe:2.3:a:sylius:syliusresourcebundle::::::::
	cpe:2.3:a:sylius:syliusresourcebundle::::::::
	cpe:2.3:a:sylius:syliusresourcebundle:1.5.0:::::::*

History

No history.

Information

Published : 2020-01-27 21:15

Updated : 2023-12-10 13:13

NVD link : CVE-2020-5220

Mitre link : CVE-2020-5220

CVE.ORG link : CVE-2020-5220

JSON object : View

Products Affected

sylius

syliusresourcebundle

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

{"id": "CVE-2020-5220", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.3}]}, "published": "2020-01-27T21:15:11.430", "references": [{"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/resource-bundle/CVE-2020-5220.yaml", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-8vp7-j5cj-vvm2", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's controller is affected. The vulnerable versions are: <1.3 || >=1.3.0 <=1.3.12 || >=1.4.0 <=1.4.5 || >=1.5.0 <=1.5.0 || >=1.6.0 <=1.6.2. The patch is provided for Sylius ResourceBundle 1.3.13, 1.4.6, 1.5.1 and 1.6.3, but not for any versions below 1.3."}, {"lang": "es", "value": "Sylius ResourceBundle acepta y usa cualquier grupo de serializaci\u00f3n para ser pasado por medio de un encabezado HTTP. Esto podr\u00eda conllevar a una exposici\u00f3n de datos mediante el uso de un grupo de serializaci\u00f3n no intencionado; por ejemplo, esto podr\u00eda hacer que la API Shop use un grupo m\u00e1s permisivo desde la API Admin. Cualquier persona que exponga una API con el controlador de ResourceBundle est\u00e1 afectada. Las versiones vulnerables son: versiones anteriores a 1.3 || versiones desde 1.3.0 hasta 1.3.12, incluy\u00e9ndolas || versiones desde 1.4.0 hasta 1.4.5, incluy\u00e9ndolas || versiones desde 1.5.0 hasta 1.5.0, incluy\u00e9ndolas || versiones desde 1.6.0 hasta 1.6.2, incluy\u00e9ndolas. El parche es proporcionado para Sylius ResourceBundle versiones 1.3.13, 1.4.6, 1.5.1 y 1.6.3, pero no para las versiones por debajo de 1.3."}], "lastModified": "2020-02-04T14:50:26.297", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16C8DF29-A40B-43A1-B2AD-B81C6521B200", "versionEndIncluding": "1.3.12", "versionStartIncluding": "1.3.0"}, {"criteria": "cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D8C80037-956E-4B8E-8634-7F48715D294A", "versionEndIncluding": "1.4.5", "versionStartIncluding": "1.4.0"}, {"criteria": "cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87B53540-066D-44C5-BE9E-0F05A9FF331D", "versionEndIncluding": "1.6.2", "versionStartIncluding": "1.6.0"}, {"criteria": "cpe:2.3:a:sylius:syliusresourcebundle:1.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7897F8D-F10F-494D-A7E4-49AFDCC80D96"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}