Podatność CVE-2020-8818

Podatność CVE-2020-8818

Publikacja: 2020-02-25

Opis:

An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or receive all of the subsequent payments.

W naszej bazie, znaleźliśmy następujące noty dla tego CVE:

	Tytuł	Autor	Data
Med.	Magento WooCommerce CardGate Payment Gateway 2.0.30 Payment Process Bypass	GeekHack	25.02.2020

Typ:

CWE-346

(Origin Validation Error)

Referencje:

https://github.com/cardgate/magento2/blob/715979e54e1a335d78a8c5586f9e9987c3bf94fd/Controller/Payment/Callback.php#L88-L107

https://github.com/cardgate/magento2/issues/54

Copyright 2024, cxsecurity.com