CVE-2020-5220 Ability to expose data in Sylius by using an unintended serialisation group
Attackers can expose sensitive data by manipulating HTTP headers to use unintended serialization groups in Sylius ResourceBundle APIs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-5220?
CVE-2020-5220 is a medium-severity vulnerability in SyliusResourceBundle, published on 27 Jan 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's controller is affected. The vulnerable versions are: <1.3 || >=1.3.0 <=1.3.12 || >=1.4.0 <=1.4.5 || >=1.5.0 <=1.5.0 || >=1.6.0 <=1.6.2. The patch is provided for Sylius ResourceBundle 1.3.13, 1.4.6, 1.5.1 and 1.6.3, but not for any versions below 1.3.
Which versions are affected by CVE-2020-5220?
It affects 1 product.
Products include Sylius Syliusresourcebundle.
How do I fix CVE-2020-5220?
Apply the vendor's patch.
Is CVE-2020-5220 being exploited?
There is no known exploitation of CVE-2020-5220 in the wild and no public exploit code.