DRUPAL-CONTRIB-2023-052

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/mollie/DRUPAL-CONTRIB-2023-052.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2023-052
Published
2023-11-15T14:24:12Z
Modified
2026-09-10T03:46:10Z
Summary
[none]
Details

This module enables you to pay online via Mollie.

The module might not properly load the correct order to update the payment status when Mollie redirects to the redirect URL. This can allow an attacker to apply other people's orders to their own, getting credit without paying.

This vulnerability is mitigated by the fact that an attacker must have some knowledge about the module's internal functionality. The issue only affects installations that use the Mollie for Drupal Commerce submodule.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/mollie

Package

Name
drupal/mollie
Purl
pkg:composer/drupal/mollie?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.2.1
Database specific
Show details 
{
    "constraint": "<2.2.1"
}

Database specific

affected_versions 
"<2.2.1"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/mollie/DRUPAL-CONTRIB-2023-052.json"