GHSA-945h-6vcv-pc8h: Sylius Admin Bundle Cross-Site Request Forgery vulnerability

May 29, 2024

Sylius 1.0.0 to 1.0.16, 1.1.0 to 1.1.8, 1.2.0 to 1.2.1 versions of AdminBundle and ResourceBundle are affected by this security issue.

This issue has been fixed in Sylius 1.0.17, 1.1.9 and 1.2.2. Development branch for 1.3 release has also been fixed.

References

github.com/FriendsOfPHP/security-advisories/blob/master/sylius/admin-bundle/2018-07-09.yaml
github.com/Sylius/SyliusAdminBundle
github.com/Sylius/SyliusAdminBundle/commit/79c2d963bed61411b1eef15715a74d2d96b91884
github.com/advisories/GHSA-945h-6vcv-pc8h
sylius.com/blog/csrf-vulnerability-in-admin-panel

Detect and mitigate GHSA-945h-6vcv-pc8h with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →