PT-2022-19502 · Silverstripe · Silverstripe-Omnipay

Lozcalver · Published 2022-06-06 · Updated 2022-06-17 · CVE-2022-29254

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions silverstripe-omnipay versions prior to 2.5.2 silverstripe-omnipay versions prior to 3.0.2 silverstripe-omnipay versions prior to 3.1.4 silverstripe-omnipay versions prior to 3.2.1

Description For a subset of Omnipay gateways, if the payment identifier or success URL is exposed, it is possible for payments to be prematurely marked as completed without payment being taken. This issue is mitigated by the fact that most payment gateways hide this information from users. However, some issuing banks offer flawed 3DSecure implementations that may inadvertently expose this data.

Recommendations For versions prior to 2.5.2, update to version 2.5.2 or later. For versions prior to 3.0.2, update to version 3.0.2 or later. For versions prior to 3.1.4, update to version 3.1.4 or later. For versions prior to 3.2.1, update to version 3.2.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-436

CWE-437

Related Identifiers

CVE-2022-29254

GHSA-48F2-M7JG-866X

Affected Products

Silverstripe-Omnipay

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29254.json · Exploit
• https://github.com/silverstripe/silverstripe-omnipay/commit/7dee9a1e0a5f54c2dc06e018cff3d9a19044e01b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-29254 · Security Note
• https://osv.dev/vulnerability/GHSA-48f2-m7jg-866x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29254 · Vendor Advisory
• https://github.com/silverstripe/silverstripe-omnipay/security/advisories/GHSA-48f2-m7jg-866x · Note
• https://github.com/silverstripe/silverstripe-omnipay/releases/tag/3.1.4 · Note
• https://github.com/silverstripe/silverstripe-omnipay · Note
• https://github.com/silverstripe/silverstripe-omnipay/releases/tag/3.0.2 · Note
• https://github.com/silverstripe/silverstripe-omnipay/releases/tag/3.2.1 · Note
• https://github.com/silverstripe/silverstripe-omnipay/releases/tag/2.5.2 · Note
• https://t.me/cvenotify/31341 · Telegram Post
• https://t.me/cvenotify/31343 · Telegram Post
• https://t.me/cibsecurity/44079 · Telegram Post
• https://t.me/cvenotify/31795 · Telegram Post