1. Home
  2. Mapping Frameworks
  3. CVE Home
  4. SyliusResourceBundle

CVE CVE-2020-15143 Mappings

In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
CVE-2020-15143 SyliusResourceBundle primary_impact T1059 Command and Scripting Interpreter
CVE-2020-15143 SyliusResourceBundle exploitation_technique T1133 External Remote Services