VULNERABILITY INTELLIGENCE

CVE-2020-15146

CVSS score9.6 CRITICAL

EPSS probability2.15%

CISA KEVNot currently listed

Published2020-08-20

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Description

In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.

Weakness classification

security-advisories@github.com: CWE-74
nvd@nist.gov: CWE-917

Primary references

security-advisories@github.com — Exploit, Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mitigation, Third Party Advisory