PT-2023-19312 · Unknown · Security Plugin+1

Highmstegmeyer · Published 2023-02-03 · Updated 2023-02-15 · CVE-2023-23941

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SwagPayPal versions prior to 5.4.4

Description The issue affects JavaScript-based PayPal checkout methods, including PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, and Credit card. When these methods are used, the amount and item list sent to PayPal may not match the ones in the created order.

Recommendations For versions prior to 5.4.4, update to version 5.4.4 to resolve the issue. As a temporary workaround, consider disabling the JavaScript-based PayPal checkout methods, such as PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, and Credit card, until the update is applied. Alternatively, use the Security Plugin in version 1.0.21 or later as a workaround.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2023-23941

GHSA-VXPM-8HCP-QH27

Affected Products

Security Plugin

Swagpaypal

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23941.json · Exploit
• https://github.com/shopware/SwagPayPal/commit/57db5f4a57ef0a1646b509b415de9f03bf441b08 · Patch
• https://osv.dev/vulnerability/GHSA-vxpm-8hcp-qh27 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-23941 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23941 · Security Note
• https://github.com/shopware/SwagPayPal/security/advisories/GHSA-vxpm-8hcp-qh27 · Note
• https://github.com/shopware/SwagPayPal · Note