PT-2017-16895 · Paypal · Paypal Merchant Sdk

Jgj212 · Publicado 2017-02-23 · Atualizado 2022-05-14 · CVE-2017-6099

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PayPal PHP Merchant SDK (aka merchant-sdk-php) version 3.9.1

Description The issue concerns a cross-site scripting (XSS) vulnerability. This allows remote attackers to inject arbitrary web script or HTML via the token parameter in the GetAuthDetails.html.php file.

Recommendations For version 3.9.1, consider restricting access to the GetAuthDetails.html.php file until a patch is available, and avoid using the token parameter in this context to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-6099

GHSA-P4G7-WJHQ-9R2H

Produtos afetados

Paypal Merchant Sdk

Referências · 6

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/paypal/merchant-sdk-php/CVE-2017-6099.yaml · Exploit
• 🔥 https://github.com/paypal/merchant-sdk-php/issues/129 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-6099 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-p4g7-wjhq-9r2h · Aviso do Fabricante
• http://securityfocus.com/bid/96432 · Nota
• https://osv.dev/vulnerability/CVE-2017-6099 · Aviso do Fabricante