GHSA-2hjh-495w-hmxc

Suggest an improvement
Source
https://github.com/advisories/GHSA-2hjh-495w-hmxc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-2hjh-495w-hmxc/GHSA-2hjh-495w-hmxc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-2hjh-495w-hmxc
Aliases
Withdrawn
2025-02-07T15:25:03Z
Published
2025-02-06T18:31:05Z
Modified
2026-09-10T03:50:56Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Withdrawn Advisory: Sylius allows unrestricted brute-force attacks on user accounts
Details

Withdrawn Advisory

This advisory has been withdrawn because it is not a vulnerability in the Sylius framework. This link is maintained to preserve external references.

Original Description

A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account compromise and denial of service for legitimate users. The Supplier's position is that the Sylius core software is not intended to address brute-force attacks; instead, customers deploying a Sylius-based system are supposed to use "firewalls, rate-limiting middleware, or authentication providers" for that functionality.

Database specific 
{
    "cwe_ids":  [
        "CWE-307"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-02-06T19:02:46Z",
    "nvd_published_at":  "2025-02-06T18:15:32Z",
    "severity":  "MODERATE"
}
References

Affected packages

Packagist / sylius/sylius

Package

Name
sylius/sylius
Purl
pkg:composer/sylius/sylius

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
2.0.2

Affected versions

v0.*
v0.1.0
v0.2.0
v0.3.0
v0.5.0
v0.6.0
v0.7.0
v0.8.0
v0.9.0
v0.10.0
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.18.0
v0.19.0
v1.*
v1.0.0-alpha.1
v1.0.0-alpha.2
v1.0.0-beta.1
v1.0.0-beta.2
v1.0.0-beta.3
v1.0.0-rc.1
v1.0.0-rc.2
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v1.0.10
v1.0.11
v1.0.12
v1.0.13
v1.0.14
v1.0.15
v1.0.16
v1.0.17
v1.0.18
v1.1.0-RC
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v1.1.10
v1.1.11
v1.1.12
v1.1.13
v1.1.14
v1.1.15
v1.1.16
v1.1.17
v1.1.18
v1.2.0-BETA
v1.2.0-RC
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.2.6
v1.2.7
v1.2.8
v1.2.9
v1.2.10
v1.2.11
v1.2.12
v1.2.13
v1.2.14
v1.2.15
v1.2.16
v1.2.17
v1.3.0-BETA
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.3.8
v1.3.9
v1.3.10
v1.3.11
v1.3.12
v1.3.13
v1.3.14
v1.3.15
v1.3.16
v1.4.0-BETA.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.4.8
v1.4.9
v1.4.10
v1.4.11
v1.4.12
v1.5.0-RC.1
v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.5.4
v1.5.5
v1.5.6
v1.5.7
v1.5.8
v1.5.9
v1.6.0-ALPHA.1
v1.6.0-ALPHA.2
v1.6.0-RC.1
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.6.7
v1.6.8
v1.6.9
v1.7.0-ALPHA.1
v1.7.0-ALPHA.2
v1.7.0-RC.1
v1.7.0
v1.7.1
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9
v1.7.10
v1.7.11
v1.8.0-RC.1
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.8.6
v1.8.7
v1.8.8
v1.8.9
v1.8.10
v1.8.11
v1.8.12
v1.9.0-ALPHA.1
v1.9.0-BETA.1
v1.9.0-ALPHA.2
v1.9.0-BETA.2
v1.9.0-BETA.3
v1.9.0-RC.1
v1.9.0-RC.2
v1.9.0
v1.9.1
v1.9.2
v1.9.3
v1.9.4
v1.9.5
v1.9.6
v1.9.7
v1.9.8
v1.9.9
v1.9.10
v1.9.11
v1.9.12
v1.9.13
v1.10.0-alpha.1
v1.10.0-beta.1
v1.10.0-rc.1
v1.10.0
v1.10.1
v1.10.2
v1.10.3
v1.10.4
v1.10.5
v1.10.6
v1.10.7
v1.10.8
v1.10.9
v1.10.10
v1.10.11
v1.10.12
v1.10.13
v1.10.14
v1.10.15
v1.10.16
v1.10.17
v1.11.0-alpha.1
v1.11.0-alpha.2
v1.11.0-beta.1
v1.11.0-rc.1
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.11.4
v1.11.5
v1.11.6
v1.11.7
v1.11.8
v1.11.9
v1.11.10
v1.11.11
v1.11.12
v1.11.13
v1.11.14
v1.11.15
v1.11.16
v1.11.17
v1.11.18
v1.12.0-alpha.1
v1.12.0-alpha.2
v1.12.0-beta.1
v1.12.0-rc.1
v1.12.0
v1.12.1
v1.12.2
v1.12.3
v1.12.4
v1.12.5
v1.12.6
v1.12.7
v1.12.8
v1.12.9
v1.12.10
v1.12.11
v1.12.12
v1.12.13
v1.12.14
v1.12.15
v1.12.16
v1.12.17
v1.12.18
v1.12.19
v1.12.20
v1.12.21
v1.12.22
v1.12.23
v1.12.24
v1.12.25
v1.13.0-alpha.1
v1.13.0-alpha.2
v1.13.0-beta.1
v1.13.0-rc.1
v1.13.0
v1.13.1
v1.13.2
v1.13.3
v1.13.4
v1.13.5
v1.13.6
v1.13.7
v1.13.8
v1.13.9
v1.13.10
v1.13.11
v1.13.12
v1.13.13
v1.13.14
v1.13.15
v1.13.16
v1.13.17
v1.14.0-alpha.1
v1.14.0-alpha.2
v1.14.0-beta.1
v1.14.0-rc.1
v1.14.0
v1.14.1
v1.14.2
v1.14.3
v1.14.4
v1.14.5
v1.14.6
v1.14.7
v1.14.8
v1.14.9
v1.14.10
v1.14.11
v1.14.12
v1.14.13
v1.14.14
v1.14.15
v1.14.16
v1.14.17
v1.14.18
v1.14.19
v1.14.20
v2.*
v2.0.0-alpha.1
v2.0.0-alpha.2
v2.0.0-alpha.3
v2.0.0-beta.1
v2.0.0-rc.1
v2.0.0
v2.0.1
v2.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-2hjh-495w-hmxc/GHSA-2hjh-495w-hmxc.json"