GHSA-489x-ccjw-q7c4

Suggest an improvement
Source
https://github.com/advisories/GHSA-489x-ccjw-q7c4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-489x-ccjw-q7c4/GHSA-489x-ccjw-q7c4.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-489x-ccjw-q7c4
Aliases
Published
2022-05-13T01:49:53Z
Modified
2024-04-23T17:43:53.425268Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Paymorrow Improper Input Validation vulnerability
Details

An issue was discovered in the Paymorrow module 1.0.0 before 1.0.2 and 2.0.0 before 2.0.1 for OXID eShop. An attacker can bypass delivery-address change detection if the payment module doesn't use eShop's checkout procedure properly. To do so, the attacker must change the delivery address to one that is not verified by the Paymorrow module.

References

Affected packages

Packagist / oxid-esales/paymorrow-module

Package

Name
oxid-esales/paymorrow-module
Purl
pkg:composer/oxid-esales/paymorrow-module

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.0.0
Fixed
1.0.2

Affected versions

v1.*

v1.0.2-RC.1

Packagist / oxid-esales/paymorrow-module

Package

Name
oxid-esales/paymorrow-module
Purl
pkg:composer/oxid-esales/paymorrow-module

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.0.1

Affected versions

v2.*

v2.0.0