CVE-2022-24743 Insufficient Session Expiration in Sylius
Attackers can reuse reset password tokens to change passwords and take over accounts due to insufficient session expiration in Sylius.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24743?
CVE-2022-24743 is a high-severity authentication bypass vulnerability in Sylius, published on 14 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue is fixed in versions 1.10.11 and 1.11.2. As a workaround, overwrite the `Sylius\Bundle\ApiBundle\CommandHandler\ResetPasswordHandler` class with code provided by the maintainers and register it in a container. More information about this workaround is available in the GitHub Security Advisory.
Weakness: CWE-613
Which versions are affected by CVE-2022-24743?
4 open source packages ship an affected version, including sylius/sylius. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sylius/sylius Packagist | From 1.10.0 | 1.10.11 |
sylius/sylius Packagist | From 1.10.0 | 1.10.11 |
sylius/sylius Packagist | From 1.11.0 | 1.11.2 |
sylius/sylius Packagist | From 1.11.0 | 1.11.2 |
Products include Sylius Sylius.
How do I fix CVE-2022-24743?
Upgrade sylius/sylius to a fixed version for your release line: 1.10.11 or 1.11.2.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-24743 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24743 exists.
Other vulnerabilities in Sylius
- CVE-2026-31824 Sylius has a Promotion Usage Limit Bypass via Race Condition
- CVE-2024-57610 Denial of service in n/a
- CVE-2026-31820 Sylius affected by IDOR in Cart and Checkout LiveComponents
- CVE-2026-31819 Sylius has an Open Redirect via Referer Header
- CVE-2026-31821 Sylius is Missing Authorization in API v2 Add Item Endpoint
Sources
Also known as GHSA-mf3v-f2qq-pf9g.