« Volver al listado

CVE-2020-15245

Estado: ModificadaMedia (4.3)—

In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one). The issue has been patched in Sylius 1.6.9, 1.7.9 and 1.8.3. As a workaround, you may resolve this issue on your own by creating a custom event listener, which will listen to the sylius.customer.pre_update event.

Leer descripción completaMostrar menos

You can determine that email has been changed if customer email and user username are different. They are synchronized later on. Pay attention, to email changing behavior for administrators. You may need to skip this logic for them. In order to achieve this, you should either check master request path info, if it does not contain /admin prefix or adjust event triggered during customer update in the shop. You can find more information on how to customize the event here.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Sylius — Sylius

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-15245",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Sylius",
          "product": "Sylius",
          "versions": [
            {
              "status": "affected",
              "version": ">= 9.0.0, < 9.4.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-10-19T21:15:12.810",
  "references": [
    {
      "url": "https://github.com/Sylius/Sylius/commit/60636d711a4011e8694d10d201b53632c7e8ecaf",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Sylius/Sylius/security/advisories/GHSA-6gw4-x63h-5499",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Sylius/Sylius/commit/60636d711a4011e8694d10d201b53632c7e8ecaf",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/Sylius/Sylius/security/advisories/GHSA-6gw4-x63h-5499",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one). The issue has been patched in Sylius 1.6.9, 1.7.9 and 1.8.3. As a workaround, you may resolve this issue on your own by creating a custom event listener, which will listen to the sylius.customer.pre_update event. You can determine that email has been changed if customer email and user username are different. They are synchronized later on. Pay attention, to email changing behavior for administrators. You may need to skip this logic for them. In order to achieve this, you should either check master request path info, if it does not contain /admin prefix or adjust event triggered during customer update in the shop. You can find more information on how to customize the event here."
    },
    {
      "lang": "es",
      "value": "En Sylius versiones anteriores a 1.6.9, 1.7.9 y 1.8.3, el usuario puede registrarse en una tienda mediante el correo electrónico mail@example.com, verificarlo, cambiarlo al correo another@domain.com y permanecer verificado y habilitado.&#xa0;Esto puede conllevar a tener cuentas dirigidas a correos electrónicos totalmente diferentes, que fueron verificados.&#xa0;Tome en cuenta que de esta manera uno no es capaz de tomar el control de ninguna cuenta existente (de invitado o normal).&#xa0;El problema ha sido parcheado en Sylius versiones 1.6.9, 1.7.9 y 1.8.3.&#xa0;Como solución alternativa, puede resolver este problema por su cuenta mediante la creación de un detector de eventos personalizado, que escuchará el evento sylius.customer.pre_update.&#xa0;Puede determinar que el correo electrónico ha sido cambiado si el correo electrónico del cliente y el nombre de usuario son diferentes.&#xa0;Estos se sincronizan más tarde.&#xa0;Preste atención al comportamiento cambiante del correo electrónico para los administradores.&#xa0;Puede necesitar omitir esta lógica para ellos.&#xa0;En función de lograr esto,&#xa0;debe comprobar la información de la ruta de petición maestra, si no contiene el prefijo /admin o ajustar el evento activado durante la actualización del cliente en la tienda.&#xa0;Puede encontrar más información sobre cómo personalizar el evento aquí"
    }
  ],
  "lastModified": "2026-06-17T02:56:20.950",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B2E8B8E9-D805-4E1A-8AB4-B06B322668DA",
              "versionEndExcluding": "1.6.9"
            },
            {
              "criteria": "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C4F2B73-6B56-4226-9F97-F5B3C2F14B4F",
              "versionEndExcluding": "1.7.9",
              "versionStartIncluding": "1.7.0"
            },
            {
              "criteria": "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B995A95C-06CD-46C4-90C4-FF42915BAFAF",
              "versionEndExcluding": "1.8.3",
              "versionStartIncluding": "1.8.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}