PT-2012-5668 · Paypal+1 · Paypal Express Checkout+1

Giancarlo Pellegrino · Publicado 2012-10-31 · Atualizado 2017-08-29 · CVE-2012-4934

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions TomatoCart version 1.1.7

Description The issue allows remote authenticated users to bypass intended payment requirements. This is possible when the PayPal Express Checkout module is enabled in sandbox mode, and a certain redirection URL is modified.

Recommendations For TomatoCart version 1.1.7, consider disabling the PayPal Express Checkout module in sandbox mode until a patch is available. Restrict access to the module to minimize the risk of exploitation. Avoid using the sandbox mode in the PayPal Express Checkout module until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-4934

Produtos afetados

Paypal Express Checkout

Tomatocart

Referências · 6

• http://osvdb.org/86883 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79696 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4934 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4934 · Nota de Segurança
• http://securityfocus.com/bid/56333 · Nota
• http://kb.cert.org/vuls/id/207540 · Nota