GitHub Advisoryadvisory · Packagist

GHSA-489x-ccjw-q7c4 Paymorrow Improper Input Validation vulnerability

MEDIUM Published 2022-05-13 Modified 2024-04-23 Official page ↗
Aliases
CVE-2018-14020
Ecosystem
Packagist
Packages
oxid-esales/paymorrow-module
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Reviewed
2024-04-23

Affected packages

• Packagist oxid-esales/paymorrow-module: >= 1.0.0, < 1.0.2 → fixed in 1.0.2 • Packagist oxid-esales/paymorrow-module: >= 2.0.0, < 2.0.1 → fixed in 2.0.1

Description

An issue was discovered in the Paymorrow module 1.0.0 before 1.0.2 and 2.0.0 before 2.0.1 for OXID eShop. An attacker can bypass delivery-address change detection if the payment module doesn't use eShop's checkout procedure properly. To do so, the attacker must change the delivery address to one that is not verified by the Paymorrow module.

Related

Alias · CVE (1)

  • CVE-2018-14020 An issue was discovered in the Paymorrow module 1.0.0 before 1.0.2 and 2.0.0 before 2.0.1 for OXID eShop. vulnerability

References