VULNERABILITY INTELLIGENCE

CVE-2020-15143

CVSS score7.7 HIGH

EPSS probability1.91%

CISA KEVNot currently listed

Published2020-08-20

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Description

In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.

Weakness classification

security-advisories@github.com: CWE-74
nvd@nist.gov: CWE-917

Primary references

security-advisories@github.com — Exploit, Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mitigation, Third Party Advisory