GHSA-945h-6vcv-pc8h: 
PHP vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Sylius AdminBundle affecting versions 1.0.0 to 1.0.16, 1.1.0 to 1.1.8, and 1.2.0 to 1.2.1. The vulnerability was identified in July 2018 and fixed in versions 1.0.17, 1.1.9, and 1.2.2 (GitHub Advisory, Sylius Blog).

The vulnerability stemmed from missing CSRF token requirements in several critical admin panel actions. The issue was assigned a CVSS v3.1 score of 6.5 (Moderate severity) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, indicating network vector attack capability with low complexity but requiring user interaction (GitHub Advisory).

The vulnerability affected several critical administrative functions including marking order payments as completed or refunded, and handling product review acceptance or rejection. The CVSS scoring indicates high impact on integrity while maintaining no impact on confidentiality and availability (GitHub Advisory).

The vulnerability could be exploited through network access, requiring low attack complexity but necessitating user interaction. The attack vector was accessible without requiring privileges, though scope was limited to the affected components (GitHub Advisory).

The vulnerability was patched by adding required CSRF token checks to the affected actions. For API contexts, the CSRF protection can be disabled by adding csrf_protection: false to the routing configuration. The fix was implemented in versions 1.0.17, 1.1.9, and 1.2.2, as well as the development branch for the 1.3 release (Sylius Blog).

The vulnerability was responsibly disclosed by Paweł Waniek, with Sylius team member Kamil providing a quick response to address the issue. The company emphasized their commitment to software quality and encouraged community involvement in security improvement (Sylius Blog).