UpHeron
All vulnerabilities

Servers and applications

CVE-2020-5218

Affected versions of Sylius give attackers the ability to switch channels via the _channel_code GET parameter in production environments. This was meant to be enabled only when kernel.debug is set to true. However, if no sylius_channel.debug is set explicitly in the configuration, the default value which is kernel.debug will be not resolved and cast to boolean, enabling this debug feature even…

Severity
Medium 4.3
Published
27 Jan 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.3.13, 1.4.6, 1.6.3
Exploit chance
0.6% in the next 30 daysHigher than 48% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
SyliusServers and applications · cpe:a:sylius:sylius
  • From 1.3.0 before 1.3.13
  • From 1.4.0 before 1.4.6
  • Version 1.5.0
  • From 1.6.0 before 1.6.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-5218
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-5218