PT-2018-4156 · Paypal · Paypal-Ipn

Publicado 2018-05-29 · Atualizado 2020-08-31 · CVE-2014-10067

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions paypal-ipn versions 2.x.x and earlier paypal-ipn versions prior to 3.0.0

Description The issue concerns a validation bypass vulnerability. paypal-ipn uses the test ipn parameter, set by the PayPal IPN simulator, to determine whether to use the production PayPal site or the sandbox. An attacker could craft a request using the simulator to fool an application into entering sandbox mode, potentially allowing purchases without valid payment.

Recommendations For versions 2.x.x and earlier, upgrade to version 3.0.0 or later. As a temporary workaround, consider explicitly checking for the test ipn parameter in production to prevent validation bypass.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2014-10067

GHSA-H698-R4HM-W94P

Produtos afetados

Paypal-Ipn

Referências · 6

• https://osv.dev/vulnerability/GHSA-h698-r4hm-w94p · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-10067 · Nota de Segurança
• https://npmjs.com/advisories/26 · Nota
• https://nodesecurity.io/advisories/26 · Nota
• ❌ https://github.com/andzdroid/paypal-ipn/issues/11 · Nota, Deleted
• ❌ https://github.com/andzdroid/paypal-ipn · Nota, Deleted