CyberRota Analysis
AI-GeneratedThe Sylius eCommerce Framework versions 2.0.0 to 2.0.17, 2.1.0 to 2.1.14, and 2.2.0 to 2.2.5 are vulnerable due to an improper workflow enforcement in the cart `FormComponent`, which allows authenticated customers to modify or delete completed orders if the cart page remains open. This vulnerability poses a risk of unauthorized order manipulation, impacting the integrity of order management. Organizations using affected versions should prioritize applying the patch or implementing the recommended workaround to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart `FormComponent`. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order’s changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order. Versions 2.0.18, 2.1.15, and 2.2.6 contain a patch. As a workaround, deployments can copy the patched `FormComponent` into the application's `src/` directory and override the `sylius_shop.twig.component.cart.form` service definition to use that class.