Read the docs
TI-2022-08557 Aliases CVE-2022-24743GHSA-mf3v-f2qq-pf9g

Insufficient Session Expiration in Sylius

Priority HIGH 69CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-613.

Summary

Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue is fixed in versions 1.10.11 and 1.11.2. As a workaround, overwrite the `Sylius\Bundle\ApiBundle\CommandHandler\ResetPasswordHandler` class with code provided by the maintainers and register it in a container. More information about this workaround is available in the GitHub Security Advisory.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01252 69th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Sylius (Sylius): 1.10.11, 1.11.2sylius/sylius (Packagist): 1.10.11, 1.11.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SyliusSyliusbefore 1.10.11; 1.11.0 to before 1.11.21.10.11, 1.11.2Patch availableCNA
—sylius/sylius (Packagist)1.10.0 to before 1.10.111.10.11Patch availableGHSA-mf3v-f2qq-pf9g
—sylius/sylius (Packagist)1.11.0 to before 1.11.21.11.2Patch availableGHSA-mf3v-f2qq-pf9g
  • Sylius VendorSylius Affected before 1.10.11; 1.11.0 to before 1.11.2 Fixed in 1.10.11, 1.11.2 Patch available CNA
  • sylius/sylius (Packagist) Vendor— Affected 1.10.0 to before 1.10.11 Fixed in 1.10.11 Patch available GHSA-mf3v-f2qq-pf9g
  • sylius/sylius (Packagist) Vendor— Affected 1.11.0 to before 1.11.2 Fixed in 1.11.2 Patch available GHSA-mf3v-f2qq-pf9g

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*1.10.0 to before 1.10.11; 1.11.0 to before 1.11.2VulnerableSylius
  • cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:* Versions 1.10.0 to before 1.10.11; 1.11.0 to before 1.11.2 Vulnerable ·Sylius

Remediation

  • Fix · CNA Sylius (Sylius) Fixed in 1.10.11, 1.11.2
  • Fix · GHSA-mf3v-f2qq-pf9g sylius/sylius (Packagist) Fixed in 1.10.11 Advisory →
  • Fix · GHSA-mf3v-f2qq-pf9g sylius/sylius (Packagist) Fixed in 1.11.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24743
  2. 2026-10-03 Alias added: GHSA-mf3v-f2qq-pf9g

References

Exploit 1

Advisory 3

Other 1

  • TI-2026-24374 Sylius is Missing Authorization in API v2 Add Item Endpoint CVSS 4.0MEDIUM 6.9
  • TI-2026-24378 Sylius has a DQL Injection via API Order Filters CVSS 3.1MEDIUM 5.3
  • TI-2024-19437 Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book. CVSS 3.1MEDIUM 6.4
  • TI-2022-08563 Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius CVSS 3.1MEDIUM 6.1
  • TI-2026-24377 Sylius has a Promotion Usage Limit Bypass via Race Condition CVSS 3.1HIGH 8.2
  • TI-2024-37963 A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted… CVSS 3.1HIGH 7.5
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences