PT-2019-9762 · Stripe · Stripe Api

Publicado 2019-01-03 · Atualizado 2019-01-31 · CVE-2018-19249

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Stripe API v1

Description The issue allows remote attackers to bypass intended access restrictions. This is achieved by replaying XMLHttpRequest data to the API endpoint "/v1/tokens" on api.stripe.com, then parsing the response under the object card{}, and reading the cvc check information if the creation is successful without charging the actual card used in the transaction.

Recommendations For Stripe API v1, as a temporary workaround, consider restricting access to the /v1/tokens API endpoint until a patch is available. Avoid using the cvc check information in the response under the card{} object until the issue is resolved.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2018-19249

Produtos afetados

Stripe Api

Referências · 3

• https://osv.dev/vulnerability/CVE-2018-19249 · Aviso do Fabricante
• https://fredmooredamian.blogspot.com/2019/01/improper-authentication-on-stripe-api-v1.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-19249 · Nota de Segurança