NVD – CVE-2021-32720

ByPR 24



CVE-2021-32720
Detail

Description

Sylius is an Open Source eCommerce platform on top of Symfony. In versions of Sylius prior to 1.9.5 and 1.10.0-RC.1, part of the details (order ID, order number, items total, and token value) of all placed orders were exposed to unauthorized users. If exploited properly, a few additional information like the number of items in the cart and the date of the shipping may be fetched as well. This data seems to not be crucial nor is personal data, however, could be used for sociotechnical attacks or may expose a few details about shop condition to the third parties. The data possible to aggregate are the number of processed orders or their value in the moment of time. The problem has been patched at Sylius 1.9.5 and 1.10.0-RC.1. There are a few workarounds for the vulnerability. The first possible solution is to hide the problematic endpoints behind the firewall from not logged in users. This would put only the order list under the firewall and allow only authorized users to access it. Once a user is authorized, it will have access to theirs orders only. The second possible solution is to decorate the `SyliusBundleApiBundleDoctrineQueryCollectionExtensionOrdersByLoggedInUserExtension` and throw `SymfonyComponentSecurityCoreExceptionAccessDeniedException` if the class is executed for unauthorized user.

Severity

 


CVSS 3.x Severity and Metrics:

References to Advisories, Solutions, and Tools


By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to nvd@nist.gov.

Weakness Enumeration









CWE-ID CWE Name Source

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor





Contributor acceptance level


GitHub, Inc.  

Change History

0 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2021-32720
NVD
Published Date:
06/28/2021
NVD
Last Modified:
06/28/2021

Source:
GitHub, Inc.


Similar Posts

Beer Brewer Molson Coors Reports Ongoing Cyber Incident

Beer Brewer Molson Coors Reports Ongoing Cyber Incident

ByPR 24

Breach Notification , Cybercrime , Fraud Management & Cybercrime Multiple Systems Impacted, Including Production and Shipping Capabilities Doug Olenick (DougOlenick) • March 11, 2021     The Molson Coors Beverage Co. reported Thursday it’s in the process of responding to an ongoing cybersecurity incident that has caused system outages throughout the brewer’s manufacturing process. See…

Belgium Interior Ministry Targeted in Cyber Attack

Belgium Interior Ministry Targeted in Cyber Attack

ByPR 24

The Belgian interior ministry has found itself the target of “sophisticated” cyber espionage, a spokesman told RTBF public television on Tuesday.  The Federal Public Service Interior’s communications director, Olivier Maerens, insisted, however, that the ministry’s servers were well protected and that the hackers had not succeeded in getting hold of the most sensitive data.  Federal…

U.S. government probes VPN hack within federal agencies, races to find clues

U.S. government probes VPN hack within federal agencies, races to find clues

ByPR 24

For at least the third time since the beginning of this year, the U.S. government is investigating a hack against federal agencies that began during the Trump administration but was only recently discovered, according to senior U.S. officials and private sector cyber defenders. It is the latest so-called supply chain cyberattack, highlighting how sophisticated, often…

Researchers warn of unpatched Kaseya Unitrends backup vulnerabilities

Researchers warn of unpatched Kaseya Unitrends backup vulnerabilities

ByPR 24

Security researchers warn of three new zero-day vulnerabilities in the Kaseya Unitrends service and advise users not to expose the service to the Internet. Kaseya Unitrends is a cloud-based enterprise backup and disaster recovery solution that is offered as a stand-alone solution or as an add-on for the Kaseya VSA remote management platform. Last week,…

Computer security world in mourning over death of Dan Kaminsky, aged 42

Computer security world in mourning over death of Dan Kaminsky, aged 42

ByPR 24

Computer security world in mourning over death of Dan Kaminsky, aged 42 | IT Security News 25. April 2021 DEF CON hails ‘an icon in all the positive ways’ Obit  Celebrated information security researcher Dan Kaminsky, known not just for his technical ability but also for his compassion and support for those in his industry,…