Description
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for known administrator email addresses with forged Host headers to intercept valid reset tokens and take over administrator accounts.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Sylius Sylius
Default version status: unaffected
1.12.0 to < 1.12.25affected1.13.0 to < 1.13.17affected1.14.0 to < 1.14.20affected2.0.0 to < 2.1.16affected2.2.0 to < 2.2.9affected
pkg:composer/sylius/syliusReferences
- https://github.com/Sylius/Sylius/security/advisories/GHSA-77w3-2367-7xvq ↗
- https://github.com/Sylius/Sylius/pull/19215 ↗
- https://github.com/Sylius/Sylius/commit/1255d75b20d3d88a5e5c8d46791504134c838480 ↗
- https://github.com/Sylius/Sylius/releases/tag/v2.2.9 ↗
- https://github.com/Sylius/Sylius ↗
- https://www.vulncheck.com/advisories/sylius-before-1.12.25-1.13.17-1.14.20-2.1.16-and-2.2.9-admin-password-reset-poisoning-via-host-header ↗