PT-2023-19312 · Unknown · Security Plugin+1

Highmstegmeyer · Publicado 2023-02-03 · Atualizado 2023-02-15 · CVE-2023-23941

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SwagPayPal versions prior to 5.4.4

Description The issue affects JavaScript-based PayPal checkout methods, including PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, and Credit card. When these methods are used, the amount and item list sent to PayPal may not match the ones in the created order.

Recommendations For versions prior to 5.4.4, update to version 5.4.4 to resolve the issue. As a temporary workaround, consider disabling the JavaScript-based PayPal checkout methods, such as PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, and Credit card, until the update is applied. Alternatively, use the Security Plugin in version 1.0.21 or later as a workaround.

Exploit

Correção

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-345

Identificadores relacionados

CVE-2023-23941

GHSA-VXPM-8HCP-QH27

Produtos afetados

Security Plugin

Swagpaypal

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23941.json · Exploit
• https://github.com/shopware/SwagPayPal/commit/57db5f4a57ef0a1646b509b415de9f03bf441b08 · Correção
• https://github.com/shopware/SwagPayPal/security/advisories/GHSA-vxpm-8hcp-qh27 · Nota
• https://github.com/shopware/SwagPayPal · Nota
• https://osv.dev/vulnerability/GHSA-vxpm-8hcp-qh27 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-23941 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-23941 · Nota de Segurança