PT-2023-10334 · Viafintech · Viafintech Barzahlen Payment Module Php Sdk

Adiebler · Published 2023-01-08 · Updated 2024-05-17 · CVE-2016-15015

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions viafintech Barzahlen Payment Module PHP SDK versions up to 2.0.0

Description A vulnerability was found in the viafintech Barzahlen Payment Module PHP SDK, affecting the verify function of the file src/Webhook.php. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high, and the exploitability is difficult.

Recommendations For viafintech Barzahlen Payment Module PHP SDK versions up to 2.0.0, upgrade to version 2.0.1 to address this issue. As a temporary workaround, consider disabling the verify function of the src/Webhook.php file until the patch is applied.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-208

Related Identifiers

CVE-2016-15015

GHSA-VG5X-6Q66-RVGX

Affected Products

Viafintech Barzahlen Payment Module Php Sdk

References · 10

• https://github.com/viafintech/Barzahlen-PHP/commit/3e7d29dc0ca6c054a6d6e211f32dae89078594c1 · Patch
• https://github.com/viafintech/Barzahlen-PHP/releases/tag/v2.0.1 · Patch
• https://github.com/viafintech/Barzahlen-PHP/pull/8 · Patch
• https://osv.dev/vulnerability/GHSA-vg5x-6q66-rvgx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-15015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-15015 · Security Note
• https://github.com/viafintech/Barzahlen-PHP · Note
• https://t.me/cvenotify/41530 · Telegram Post
• https://vuldb.com/?ctiid.217650 · Note
• https://vuldb.com/?id.217650 · Note