« Volver al listado

CVE-2024-40633

Estado: AplazadaMedia (5.3)—

Sylius is an Open Source eCommerce Framework on Symfony. A security vulnerability was discovered in the `/api/v2/shop/adjustments/{id}` endpoint, which retrieves order adjustments based on incremental integer IDs. The vulnerability allows an attacker to enumerate valid adjustment IDs and retrieve order tokens. Using these tokens, an attacker can access guest customer order details - sensitive guest customer information. The issue is fixed in versions: 1.12.19, 1.13.4 and above. The `/api/v2/shop/adjustments/{id}` will always return `404` status. Users are advised to upgrade. Users unable to upgrade may alter their config to mitigate this issue. Please see the linked GHSA for details.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Sylius — SyliusAISymfony — SymfonyAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-40633",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-40633",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-17T19:06:37.163426Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Sylius",
          "product": "Sylius",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.12.19"
            },
            {
              "status": "affected",
              "version": ">= 1.13.0, < 1.13.4"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*"
          ],
          "vendor": "sylius",
          "product": "sylius",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.12.19",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.12",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.13.4",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-07-17T18:15:04.107",
  "references": [
    {
      "url": "https://github.com/Sylius/Sylius/security/advisories/GHSA-55rf-8q29-4g43",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Sylius/Sylius/security/advisories/GHSA-55rf-8q29-4g43",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sylius is an Open Source eCommerce Framework on Symfony. A security vulnerability was discovered in the `/api/v2/shop/adjustments/{id}` endpoint, which retrieves order adjustments based on incremental integer IDs. The vulnerability allows an attacker to enumerate valid adjustment IDs and retrieve order tokens. Using these tokens, an attacker can access guest customer order details - sensitive guest customer information.  The issue is fixed in versions: 1.12.19, 1.13.4 and above. The `/api/v2/shop/adjustments/{id}` will always return `404` status. Users are advised to upgrade. Users unable to upgrade may alter their config to mitigate this issue. Please see the linked GHSA for details."
    },
    {
      "lang": "es",
      "value": "Sylius es un framework de comercio electrónico de código abierto en Symfony. Se descubrió una vulnerabilidad de seguridad en el endpoint `/api/v2/shop/adjustments/{id}`, que recupera ajustes de pedidos basados en ID de enteros incrementales. La vulnerabilidad permite a un atacante enumerar ID de ajuste válidos y recuperar tokens de pedido. Al utilizar estos tokens, un atacante puede acceder a los detalles del pedido de los clientes invitados: información confidencial del cliente invitado. El problema se solucionó en las versiones: 1.12.19, 1.13.4 y superiores. `/api/v2/shop/adjustments/{id}` siempre devolverá el estado `404`. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar pueden modificar su configuración para mitigar este problema. Consulte la GHSA vinculada para obtener más detalles."
    }
  ],
  "lastModified": "2026-06-17T07:46:12.587",
  "sourceIdentifier": "security-advisories@github.com"
}