{"id":"CVE-2020-5220","details":"Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's controller is affected. The vulnerable versions are: \u003c1.3 || \u003e=1.3.0 \u003c=1.3.12 || \u003e=1.4.0 \u003c=1.4.5 || \u003e=1.5.0 \u003c=1.5.0 || \u003e=1.6.0 \u003c=1.6.2. The patch is provided for Sylius ResourceBundle 1.3.13, 1.4.6, 1.5.1 and 1.6.3, but not for any versions below 1.3.","aliases":["CVE-2020-5218","GHSA-8vp7-j5cj-vvm2","GHSA-prg5-hg25-8grq"],"modified":"2026-07-09T12:33:17.917839Z","published":"2020-01-27T21:15:11.430Z","references":[{"type":"ADVISORY","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/resource-bundle/CVE-2020-5220.yaml"},{"type":"ADVISORY","url":"https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-8vp7-j5cj-vvm2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sylius/syliusresourcebundle","events":[{"introduced":"6e0cf7a34719b3cb8150aae1ca5f0a6b5474d36f"},{"last_affected":"76aaa85748b13297448d1307392472e14dfa2266"},{"introduced":"74abc146ad690ec43354d25fec65bd068e849b07"},{"last_affected":"689b02c33cac08a217d09b85251a87995396448a"},{"introduced":"862fbfea9e310646232c97d907b04df9d99b42d4"},{"last_affected":"240f7d1b989ad3e6005a1d0926350ae25899b854"},{"introduced":"1eb55aa25d96e140989464c012f6e1c954f5d223"},{"last_affected":"1eb55aa25d96e140989464c012f6e1c954f5d223"}],"database_specific":{"cpe":["cpe:2.3:a:sylius:syliusresourcebundle:*:*:*:*:*:*:*:*","cpe:2.3:a:sylius:syliusresourcebundle:1.5.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.3.0"},{"last_affected":"1.3.12"},{"introduced":"1.4.0"},{"last_affected":"1.4.5"},{"introduced":"1.6.0"},{"last_affected":"1.6.2"},{"introduced":"1.5.0"},{"last_affected":"1.5.0"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["1.5.0","v1.6.2","v1.5.0","v1.4.5","v1.6.1","v1.6.0","v1.4.4","v1.3.12","v1.4.3","v1.4.2","v1.3.11","v1.3.10","v1.4.1","v1.3.9","v1.4.0","v1.3.8","v1.3.7","v1.3.6","v1.3.5","v1.3.4","v1.3.3","v1.3.2","v1.3.1","v1.3.0-BETA","v1.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-5220.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}