GHSA-65v7-wg35-2qpm: Sylius Resource Bundle Cross-Site Request Forgery vulnerability

May 29, 2024

Sylius 1.0.0 to 1.0.16, 1.1.0 to 1.1.8, 1.2.0 to 1.2.1 versions of AdminBundle and ResourceBundle are affected by this security issue.

This issue has been fixed in Sylius 1.0.17, 1.1.9 and 1.2.2. Development branch for 1.3 release has also been fixed.

References

github.com/FriendsOfPHP/security-advisories/blob/master/sylius/sylius/2018-07-09.yaml
github.com/Sylius/SyliusResourceBundle
github.com/Sylius/SyliusResourceBundle/commit/9720ac5a0a39ea2c2a395ef16a94a00aa86c418b
github.com/advisories/GHSA-65v7-wg35-2qpm
sylius.com/blog/csrf-vulnerability-in-admin-panel

Code Behaviors & Features

Detect and mitigate GHSA-65v7-wg35-2qpm with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →