CVE-2020-5218

描述

### Impact This vulnerability gives the ability to switch channels via the `_channel_code` GET parameter in production environments. This was meant to be enabled only when `%kernel.debug%` is set to true. However, if no `sylius_channel.debug` is set explicitly in the configuration, the default value which is `%kernel.debug%` will be not resolved and cast to boolean, enabling this debug feature even if that parameter is set to false. ### Patches Patch has been provided for Sylius 1.3.x and newer - **1.3.16, 1.4.12, 1.5.9, 1.6.5**. Versions older than 1.3 are not covered by our security support anymore. ### Workarounds Unsupported versions could be patched by adding the following configuration to run in production: ```yaml sylius_channel: debug: false ```

如何修補 CVE-2020-5218

要修補 CVE-2020-5218,請將受影響套件升級到下列已修補版本。

• —升級至 1.4.6 或更新版本
• —升級至 1.3.12 或更新版本
• —升級至 1.3.16 或更新版本

CVE-2020-5218 正在被利用嗎?

低 — EPSS 為 0.6%,目前沒有觀察到大規模利用活動。

受影響套件(3)

• >= 1.4.0, < 1.4.6
• from 0, < 1.3.12
• from 0, < 1.3.16

CVSS 分數

參考連結(6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-5218
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-5220
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/sylius/resource-bundle/CVE-2020-5220.yaml
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/sylius/sylius/CVE-2020-5220.yaml