Threats tagged 'ghsa-5597-7rmh-97q5'

Sylius versions prior to 2.0.18, 2.1.15, and 2.2.6 contain a vulnerability in the Cart FormComponent that allows modification or deletion of an already-completed order. This occurs because the cart page in the browser does not reflect changes made to the order status in the background, allowing actions such as clearing the cart, removing products, or changing quantities to corrupt or delete completed order data irreversibly.