PT-2026-29217 · Unknown · Business::Onlinepayment::Storedtransaction

Publicado 2026-03-31 · Atualizado 2026-04-02 · CVE-2025-15618

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Business::OnlinePayment::StoredTransaction versions through 0.01

Description The software generates a secret key using an MD5 hash of a single call to the rand function, which is not suitable for cryptographic purposes. This key is used for encrypting credit card transaction data.

Recommendations Versions prior to 0.01 should be updated.

Correção

Protection Mechanism Failure

Enumeração de Fraquezas

CWE-693

CWE-338

Identificadores relacionados

CVE-2025-15618

Produtos afetados

Business::Onlinepayment::Storedtransaction

Referências · 8

• https://twitter.com/TheHackerWire/status/2039024977136288145 · Publicação no Twitter
• https://twitter.com/CosmicBytez/status/2039270378393239754 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2039004497343623300 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-15618 · Nota de Segurança
• https://twitter.com/oss_security/status/2039551111267287255 · Publicação no Twitter
• https://security.metacpan.org/patches/B/Business-OnlinePayment-StoredTransaction/0.01/CVE-2025-15618-r1.patch · Correção
• https://metacpan.org/dist/Business-OnlinePayment-StoredTransaction/source/lib/Business/OnlinePayment/StoredTransaction.pm#L64-75 · Nota
• http://openwall.com/lists/oss-security/2026/03/31/7 · Nota