What is GHSA-prg5-hg25-8grq?

GHSA-prg5-hg25-8grq is a security advisory published by GitHub Security Advisories with Low severity. Ability to switch channels via GET parameter enabled in production environments

Which CVE IDs does GHSA-prg5-hg25-8grq cover?

GHSA-prg5-hg25-8grq covers the following CVE IDs: CVE-2020-5218. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-prg5-hg25-8grq?

GHSA-prg5-hg25-8grq has a CVSS v3 base score of 4.4, published by GitHub Security Advisories.

Which products are affected by GHSA-prg5-hg25-8grq?

GHSA-prg5-hg25-8grq affects 4 products, including: composer/sylius/sylius:\u003c 1.3.16; composer/sylius/sylius:\u003e= 1.4.0, \u003c 1.4.12; composer/sylius/sylius:\u003e= 1.5, \u003c 1.5.9; composer/sylius/sylius:\u003e= 1.6.0, \u003c 1.6.5.

GHSA-prg5-hg25-8grqLowCVSS 4.4

Ability to switch channels via GET parameter enabled in production environments

Vendor

GitHub Security Advisories

Published

January 31, 2020

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2020-5218 →

📋 Description

Impact

This vulnerability gives the ability to switch channels via the _channel_code GET parameter in production environments. This was meant to be enabled only when %kernel.debug% is set to true.

However, if no sylius_channel.debug is set explicitly in the configuration, the default value which is %kernel.debug% will be not resolved and cast to boolean, enabling this debug feature even if that parameter is set to false.

Patches

Patch has been provided for Sylius 1.3.x and newer - 1.3.16, 1.4.12, 1.5.9, 1.6.5. Versions older than 1.3 are not covered by our security support anymore.

Workarounds

Unsupported versions could be patched by adding the following configuration to run in production:

sylius_channel:
    debug: false

🎯 Affected products4

composer/sylius/sylius:< 1.3.16
composer/sylius/sylius:>= 1.4.0, < 1.4.12
composer/sylius/sylius:>= 1.5, < 1.5.9
composer/sylius/sylius:>= 1.6.0, < 1.6.5