CVE-2020-15245: 
PHP vulnerability analysis and mitigation

CVE-2020-15245 affects Sylius versions prior to 1.6.9, 1.7.9, and 1.8.3. The vulnerability allows users to change their email address on the account detail page while maintaining their verified status. After registering with an initial email address and verifying it, users could change their email to a different address while retaining verification status and account enablement (Sylius Advisory).

The vulnerability stems from improper handling of email verification status during email address changes. When a user modifies their email address, the system fails to reset the verification status and account enablement flags appropriately. This could result in accounts having verified status for unverified email addresses (Sylius Advisory). The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (NVD).

The vulnerability allows users to maintain verified status after changing their email address to an unverified one. While this does not allow takeover of existing accounts (guest or normal), it could lead to accounts being verified for email addresses that haven't gone through the proper verification process (Sylius Advisory).

The vulnerability can be exploited by any authenticated user with access to the account detail page. The exploitation process involves registering with an initial email, verifying it, and then changing the email address through the account settings (Sylius Advisory).

The issue has been patched in Sylius versions 1.6.9, 1.7.9, and 1.8.3. For users unable to upgrade, a workaround involves creating a custom event listener for the sylius.customer.pre_update event. The listener should check if the customer email and user username are different to detect email changes. Special consideration should be given to administrator email changes by checking the master request path info for the /admin prefix (Sylius Advisory).