High severity · published Mar 14, 2022
CVE-2022-24743
Sylius is an open source eCommerce platform
8.2
CVSS
1.3%
EPSS
No
On KEV
Description
Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue is fixed in versions 1.10.11 and 1.11.2. As a workaround, overwrite the `Sylius\Bundle\ApiBundle\CommandHandler\ResetPasswordHandler` class with code provided by the maintainers and register it in a container. More information about this workaround is available in the GitHub Security Advisory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Sylius · Sylius
1.10.0 before 1.10.11; 1.11.0 before 1.11.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24743
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-24743
Third Party Advisory
https://github.com/Sylius/Sylius/releases/tag/v1.10.11
Third Party Advisory
https://github.com/Sylius/Sylius/releases/tag/v1.11.2
Exploit
https://github.com/Sylius/Sylius/security/advisories/GHSA-mf3v-f2qq-pf9g
More from Sylius
8.8
CVE-2026-100871
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
8.8
CVE-2026-100870
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header
7.5
CVE-2026-100872
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
7.5
CVE-2024-57610
A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account…
6.5
CVE-2026-53637
Sylius: Cart FormComponent allows modification or deletion of an already-completed order