{"answers":{"affected":"6 open source packages ship an affected version, including sylius/admin-bundle.","exploited":"There is no known exploitation of GHSA-945h-6vcv-pc8h in the wild and no public exploit code.","fix":"Upgrade sylius/admin-bundle to a fixed version for your release line: 1.0.17, 1.1.9 or 1.2.2.","what":"GHSA-945h-6vcv-pc8h is a vulnerability in sylius/admin-bundle, published on 29 May 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-945h-6vcv-pc8h and fix it if it is affected.\n\nWhat it is: GHSA-945h-6vcv-pc8h is a vulnerability in sylius/admin-bundle, published on 29 May 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-945h-6vcv-pc8h in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- sylius/admin-bundle (Packagist): affected from 1.0.0; fixed in 1.0.17\n- sylius/admin-bundle (Packagist): affected from 1.0.0; fixed in 1.0.17\n- sylius/admin-bundle (Packagist): affected from 1.1.0; fixed in 1.1.9\n- sylius/admin-bundle (Packagist): affected from 1.1.0; fixed in 1.1.9\n- sylius/admin-bundle (Packagist): affected from 1.2.0; fixed in 1.2.2\n- sylius/admin-bundle (Packagist): affected from 1.2.0; fixed in 1.2.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-945h-6vcv-pc8h/ (Markdown: https://insights.sbomify.com/GHSA-945h-6vcv-pc8h/index.md)","id":"GHSA-945h-6vcv-pc8h","markdown":"https://insights.sbomify.com/GHSA-945h-6vcv-pc8h/index.md","name":"GHSA-945h-6vcv-pc8h","record":{"aliases":[],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Sylius Admin Bundle","requires_auth":"high_privilege","summary":"Attackers can trick authenticated admins into modifying order payments or product reviews without proper CSRF protection.","user_interaction":"required","vuln_class":"csrf"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Sylius 1.0.0 to 1.0.16, 1.1.0 to 1.1.8, 1.2.0 to 1.2.1 versions of AdminBundle and ResourceBundle are affected by this security issue.\n\nThis issue has been fixed in Sylius 1.0.17, 1.1.9 and 1.2.2. Development branch for 1.3 release has also been fixed.\n\n### Description\n\nThe following actions in the admin panel did not require a CSRF token:\n\n- marking order’s payment as completed\n- marking order’s payment as refunded\n- marking product review as accepted\n- marking product review as rejected\n\n### Resolution\n\nThe issue is fixed by adding a required CSRF token to those actions.\n\nWe also fixed `ResourceController`‘s  `applyStateMachineTransitionAction` method by adding a CSRF token check. If you use that action in the API context, you can disable it by adding `csrf_protection:` false to its routing configuration","ecosystems":["Packagist"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Sylius Admin Bundle Cross-Site Request Forgery vulnerability","id":"GHSA-945h-6vcv-pc8h","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"csrf","year":"2024"},"n_packages":6,"n_references":null,"packages":[{"ecosystem":"Packagist","fixed":["1.0.17"],"introduced":["1.0.0"],"last_affected":[],"package":"sylius/admin-bundle","purl":null,"source":"GHSA-945h-6vcv-pc8h"},{"ecosystem":"Packagist","fixed":["1.0.17"],"introduced":["1.0.0"],"last_affected":[],"package":"sylius/admin-bundle","purl":"pkg:composer/sylius/admin-bundle","source":"GHSA-945h-6vcv-pc8h"},{"ecosystem":"Packagist","fixed":["1.1.9"],"introduced":["1.1.0"],"last_affected":[],"package":"sylius/admin-bundle","purl":null,"source":"GHSA-945h-6vcv-pc8h"},{"ecosystem":"Packagist","fixed":["1.1.9"],"introduced":["1.1.0"],"last_affected":[],"package":"sylius/admin-bundle","purl":"pkg:composer/sylius/admin-bundle","source":"GHSA-945h-6vcv-pc8h"},{"ecosystem":"Packagist","fixed":["1.2.2"],"introduced":["1.2.0"],"last_affected":[],"package":"sylius/admin-bundle","purl":null,"source":"GHSA-945h-6vcv-pc8h"},{"ecosystem":"Packagist","fixed":["1.2.2"],"introduced":["1.2.0"],"last_affected":[],"package":"sylius/admin-bundle","purl":"pkg:composer/sylius/admin-bundle","source":"GHSA-945h-6vcv-pc8h"}],"products":null,"published":"2024-05-29","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can trick authenticated admins into modifying order payments or product reviews without proper CSRF protection.","url":"https://insights.sbomify.com/GHSA-945h-6vcv-pc8h/"}