GCVE - cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Sylius (`09c994bc-1943-5531-ab63-45ba7c30d733`)
Product	Syliusresourcebundle (`0f8d5d0e-d1cb-5ae5-b64b-492e5120d69f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/sylius/syliusresourcebundle`	purl2cpe	2026-06-01 10:11:40.801044

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-5220`	vulnerable	2026-06-08 05:26:41.530325	Ability to expose data in Sylius by using an unintended serialisation group MEDIUM (4.4) Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's controller is affected. The vulnerable versions are: <1.3 \|\| >=1.3.0 <=1.3.12 \|\| >=1.4.0 <=1.4.5 \|\| >=1.5.0 <=1.5.0 \|\| >=1.6.0 <=1.6.2. The patch is provided for Sylius ResourceBundle 1.3.13, 1.4.6, 1.5.1 and 1.6.3, but not for any versions below 1.3. Published: 2020-01-27T20:15:17.000Z Updated: 2024-08-04T08:22:08.763Z Open on db.gcve.eu Reference links https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-8vp7-j5cj-vvm2 https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/resource-bundle/CVE-2020-5220.yaml	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-15146`	vulnerable	2026-06-08 05:19:25.367369	Remote Code Execution in SyliusResourceBundle CRITICAL (9.6) In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched. Published: 2020-08-19T20:20:12.000Z Updated: 2024-08-04T13:08:22.235Z Open on db.gcve.eu Reference links https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-h6m7-j4h3-9rf5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-15143`	vulnerable	2026-06-08 05:19:25.364904	Remote Code Execution in SyliusResourceBundle HIGH (7.7) In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched. Published: 2020-08-19T20:40:12.000Z Updated: 2024-08-04T13:08:22.247Z Open on db.gcve.eu Reference links https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-p4pj-9g59-4ppv	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.