GHSA-489x-ccjw-q7c4

Source

https://github.com/advisories/GHSA-489x-ccjw-q7c4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-489x-ccjw-q7c4/GHSA-489x-ccjw-q7c4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-489x-ccjw-q7c4

Aliases

CVE-2018-14020

Published

2022-05-13T01:49:53Z

Modified

2024-12-05T05:42:39.058337Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Paymorrow Improper Input Validation vulnerability

Details

An issue was discovered in the Paymorrow module 1.0.0 before 1.0.2 and 2.0.0 before 2.0.1 for OXID eShop. An attacker can bypass delivery-address change detection if the payment module doesn't use eShop's checkout procedure properly. To do so, the attacker must change the delivery address to one that is not verified by the Paymorrow module.

Database specific

{
    "nvd_published_at": "2018-08-20T22:29:00Z",
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-23T17:25:44Z"
}

References

Affected packages

Packagist / oxid-esales/paymorrow-module

Package

Name: oxid-esales/paymorrow-module
Purl: pkg:composer/oxid-esales/paymorrow-module

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.0.0

Fixed

1.0.2

Affected versions

v1.*

v1.0.2-RC.1

Packagist / oxid-esales/paymorrow-module

Package

Name: oxid-esales/paymorrow-module
Purl: pkg:composer/oxid-esales/paymorrow-module

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.0.1

Affected versions

v2.*

v2.0.0