High severity7.7NVD Advisory· Published Aug 20, 2020· Updated Jun 17, 2026
CVE-2020-15143
CVE-2020-15143
Description
In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
sylius/resource-bundlePackagist | >= 1.4.0, < 1.4.7 | 1.4.7 |
sylius/resource-bundlePackagist | >= 1.5.0, < 1.5.2 | 1.5.2 |
sylius/resource-bundlePackagist | >= 1.6.0, < 1.6.4 | 1.6.4 |
sylius/resource-bundlePackagist | >= 1.0.0, < 1.3.14 | 1.3.14 |
Affected products
3- Sylius/SyliusResourceBundlev5Range: < 1.3.14
Patches
Vulnerability mechanics
References
5- github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-p4pj-9g59-4ppvnvdExploitMitigationThird Party AdvisoryWEB
- github.com/advisories/GHSA-p4pj-9g59-4ppvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-15143ghsaADVISORY
- github.com/FriendsOfPHP/security-advisories/blob/master/sylius/resource-bundle/CVE-2020-15143.yamlghsaWEB
- github.com/Sylius/SyliusResourceBundle/commit/73ed8b8bb083f36c30ad7c3cec336f65d6a80650ghsaWEB
News mentions
0No linked articles in our index yet.