PT-2018-12282 · Paymorrow · Paymorrow Module

Publicado 2018-08-20 · Atualizado 2022-05-13 · CVE-2018-14020

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Paymorrow module versions 1.0.0 through 1.0.1 Paymorrow module versions 2.0.0

Description The issue allows an attacker to bypass delivery-address change detection if the payment module doesn't use eShop's checkout procedure properly. This can be done by changing the delivery address to one that is not verified by the Paymorrow module.

Recommendations For Paymorrow module versions 1.0.0 through 1.0.1, update to version 1.0.2 to resolve the issue. For Paymorrow module version 2.0.0, update to version 2.0.1 to resolve the issue.

Correção

Identificadores relacionados

CVE-2018-14020

GHSA-489X-CCJW-Q7C4

Produtos afetados

Paymorrow Module

Referências · 6

• https://github.com/OXID-eSales/paymorrow-module · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-14020 · Nota de Segurança
• https://bugs.oxid-esales.com/view.php?id=6801 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-489x-ccjw-q7c4 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-14020 · Aviso do Fabricante
• https://oxidforge.org/en/security-bulletin-2018-003.html · Aviso do Fabricante