🛡️ GHSA-945h-6vcv-pc8h — admin-bundle

⚪ Unknown ✅ No Known Exploit OSV

N/A

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

Sylius Admin Bundle Cross-Site Request Forgery vulnerability

Sylius 1.0.0 to 1.0.16, 1.1.0 to 1.1.8, 1.2.0 to 1.2.1 versions of AdminBundle and ResourceBundle are affected by this security issue.

This issue has been fixed in Sylius 1.0.17, 1.1.9 and 1.2.2. Development branch for 1.3 release has also been fixed.

Description

The following actions in the admin panel did not require a CSRF token:

marking order’s payment as completed
marking order’s payment as refunded
marking product review as accepted
marking product review as rejected

Resolution

The issue is fixed by adding a required CSRF token to those actions.

We also fixed ResourceController‘s applyStateMachineTransitionAction method by adding a CSRF token check. If you use that action in the API context, you can disable it by adding csrf_protection: false to its routing configuration

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. A user must be tricked into taking some action. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity high, availability none.

Affected software

GHSA-945h-6vcv-pc8h is recorded against 1 package.

sylius/admin-bundle (from 1.2.0 up to 1.2.2)

Timeline and source

Published on 29 May 2024 and last revised on 4 December 2024. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

github.com (Web)
github.com (Web)
github.com (Package)
sylius.com (Web)

Details

Severity Unknown

CVSS Score N/A

CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE N/A

Public Exploit ✅ No

Source OSV

Published 2024-05-29

Updated 2026-08-20

Modified 2024-12-04

Fix URL N/A

Affected Packages

Software	From version	Fixed in
sylius/admin-bundle	1.2.0	1.2.2

References

WEB https://github.com/Sylius/SyliusAdminBundle/commit/79c2d963bed61411b1eef15715a74d2d96b91884

WEB https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/admin-bundle/2018-07-09.yaml

PACKAGE https://github.com/Sylius/SyliusAdminBundle

WEB https://sylius.com/blog/csrf-vulnerability-in-admin-panel

🔗 NVD 🔗 Mitre

Free Vulnerability Check

Is your site affected by GHSA-945h-6vcv-pc8h?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against GHSA-945h-6vcv-pc8h and other known CVE records.

Scan My Site Free →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.