CVE-2018-14020 Paymorrow Improper Input Validation vulnerability
Attackers can bypass delivery address verification in the Paymorrow module by circumventing the checkout procedure, potentially leading to unauthorized transactions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-14020?
CVE-2018-14020 is a medium-severity vulnerability in n/a, published on 20 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the Paymorrow module 1.0.0 before 1.0.2 and 2.0.0 before 2.0.1 for OXID eShop. An attacker can bypass delivery-address change detection if the payment module doesn't use eShop's checkout procedure properly. To do so, the attacker must change the delivery address to one that is not verified by the Paymorrow module.
Which versions are affected by CVE-2018-14020?
4 open source packages ship an affected version, including oxid-esales/paymorrow-module. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
oxid-esales/paymorrow-module Packagist | From 1.0.0 | 1.0.2 |
oxid-esales/paymorrow-module Packagist | From 1.0.0 | 1.0.2 |
oxid-esales/paymorrow-module Packagist | From 2.0.0 | 2.0.1 |
oxid-esales/paymorrow-module Packagist | From 2.0.0 | 2.0.1 |
Products include Paymorrow Paymorrow.
How do I fix CVE-2018-14020?
Upgrade oxid-esales/paymorrow-module to a fixed version for your release line: 1.0.2 or 2.0.1.
Is CVE-2018-14020 being exploited?
There is no known exploitation of CVE-2018-14020 in the wild and no public exploit code.
Sources
Also known as GHSA-489x-ccjw-q7c4.