PT-2023-10334 · Viafintech · Viafintech Barzahlen Payment Module Php Sdk

Adiebler · Publicado 2023-01-08 · Atualizado 2024-05-17 · CVE-2016-15015

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions viafintech Barzahlen Payment Module PHP SDK versions up to 2.0.0

Description A vulnerability was found in the viafintech Barzahlen Payment Module PHP SDK, affecting the verify function of the file src/Webhook.php. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high, and the exploitability is difficult.

Recommendations For viafintech Barzahlen Payment Module PHP SDK versions up to 2.0.0, upgrade to version 2.0.1 to address this issue. As a temporary workaround, consider disabling the verify function of the src/Webhook.php file until the patch is applied.

Correção

Side Channel Attack

Enumeração de Fraquezas

CWE-203

CWE-208

Identificadores relacionados

CVE-2016-15015

GHSA-VG5X-6Q66-RVGX

Produtos afetados

Viafintech Barzahlen Payment Module Php Sdk

Referências · 10

• https://github.com/viafintech/Barzahlen-PHP · Nota
• https://github.com/viafintech/Barzahlen-PHP/commit/3e7d29dc0ca6c054a6d6e211f32dae89078594c1 · Correção
• https://github.com/viafintech/Barzahlen-PHP/releases/tag/v2.0.1 · Correção
• https://github.com/viafintech/Barzahlen-PHP/pull/8 · Correção
• https://t.me/cvenotify/41530 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-vg5x-6q66-rvgx · Aviso do Fabricante
• https://vuldb.com/?ctiid.217650 · Nota
• https://osv.dev/vulnerability/CVE-2016-15015 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-15015 · Nota de Segurança
• https://vuldb.com/?id.217650 · Nota