PT-2026-31362 · Crates.Io · Mpp

Publicado 2026-03-29 · Atualizado 2026-03-29

OSV

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

Impact

Multiple vulnerabilities were discovered which allowed for undesirable behaviors, including:

• Performing free tempo/charge requests
• Replaying existing tempo/charge requests
• Performing free tempo/session requests
• Piggybacking off existing tempo/session channels
• Griefing existing tempo/session channels
• Manipulate the fee payer of a tempo/charge or tempo/session handler into paying for requests
• Replaying existing stripe/charge requests

Patches

The issues are patched in 0.8.0

Workarounds

There are no workarounds available for these vulnerabilities

Correção

Insufficient Verification of Data Authenticity

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-345

CWE-288

CWE-294

Identificadores relacionados

GHSA-FXC9-7J2W-VX54

Produtos afetados

Mpp

Referências · 4

• https://github.com/tempoxyz/mpp-rs/security/advisories/GHSA-fxc9-7j2w-vx54 · Nota
• https://github.com/tempoxyz/mpp-rs/releases/tag/v0.8.0 · Nota
• https://github.com/tempoxyz/mpp-rs · Nota
• https://osv.dev/vulnerability/GHSA-fxc9-7j2w-vx54 · Aviso do Fabricante