PT-2023-33067 · Mollie+2 · Mollie+2

Published 2023-11-17 · Updated 2023-11-17

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vendure versions prior to 2.1.3

Description The issue allows selecting any currency code, not limited to those assigned to the channel, and completing payments through Mollie and Stripe in that currency. This results in orders being settled in a foreign currency without transforming prices. The root cause is the ability to specify an arbitrary currencyCode as a query parameter in an API call, which is then used by the system.

Recommendations For versions prior to 2.1.3, update to version 2.1.3 to resolve the issue. As a temporary workaround, consider defining a custom OrderProcess with an onTransitionStart function to verify the order's currencyCode before allowing the transition to the ArrangingPayment state.

Fix

Related Identifiers

GHSA-WM63-7627-CH33

Affected Products

Mollie

Stripe

Vendure

References · 4

• https://osv.dev/vulnerability/GHSA-wm63-7627-ch33 · Vendor Advisory
• https://github.com/vendure-ecommerce/vendure/security/advisories/GHSA-wm63-7627-ch33 · Note
• https://github.com/vendure-ecommerce/vendure/commit/5e506fd8ba9f7e20030c329e62af1140d906121f · Note
• https://github.com/vendure-ecommerce/vendure · Note