Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

sylius/admin-bundle

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5PackagistPublished

    Sylius Admin Bundle Cross-Site Request Forgery vulnerability

    GHSA-945h-6vcv-pc8h

    Affected
    • Packagist sylius/admin-bundle >= 1.0.0, < 1.0.17; >= 1.1.0, < 1.1.9; >= 1.2.0, < 1.2.2
    Fixed in
    1.1.91.2.21.0.17· Vendor fix available
    Issue
    Sylius 1.0.0 to 1.0.16, 1.1.0 to 1.1.8, 1.2.0 to 1.2.1 versions of AdminBundle and ResourceBundle are affected by this security issue. This issue has been fixed in Sylius 1.0.17, 1.1.9 and 1.2.2. Development branch for 1.3 release has also been fixed. Description The following actions in the admin panel did not require a CSRF token: - marking order’s payment as completed - marking order’s payment as refunded - marking product review as accepted - marking product review as rejected Resolution The issue is fixed by adding a required CSRF token to those actions. We also fixed ResourceController‘s applyStateMachineTransitionAction method by adding a CSRF token check. If you use that action in the API context, you can disable it by adding csrfprotection: false to its routing configuration

    Recommended action: Upgrade to 1.2.2, 1.1.9 or 1.0.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →