{"answers":{"affected":"2 open source packages ship an affected version, including swag/paypal. It affects 1 product.","exploited":"There is no known exploitation of CVE-2023-23941 in the wild and no public exploit code.","fix":"Upgrade swag/paypal to 5.4.4 or later.","what":"CVE-2023-23941 is a high-severity vulnerability in shopware SwagPayPal, published on 3 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-23941 and fix it if it is affected.\n\nWhat it is: CVE-2023-23941 is a high-severity vulnerability in shopware SwagPayPal, published on 3 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-23941 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- swag/paypal (Packagist): affected all versions; fixed in 5.4.4\n- swag/paypal (Packagist): affected all versions; fixed in 5.4.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-23941/ (Markdown: https://insights.sbomify.com/CVE-2023-23941/index.md)","id":"CVE-2023-23941","markdown":"https://insights.sbomify.com/CVE-2023-23941/index.md","name":"CVE-2023-23941","record":{"aliases":["GHSA-vxpm-8hcp-qh27"],"analysis":{"component_type":"cms_plugin","fix_type":"upgrade","impacts":["data_modify"],"network_reachable":"yes","non_default_config":true,"product_category":"Shopware PayPal plugin","requires_auth":"none","summary":"Attackers can manipulate order amounts and item lists in PayPal checkout flows, leading to financial discrepancies in Shopware stores.","user_interaction":"not_required","vuln_class":"business_logic"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"swagpaypal","vendor":"shopware"}],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-345","name":"Insufficient Verification of Data Authenticity"}],"description":"SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one in the created order. The problem has been fixed with version 5.4.4. As a workaround, disable the aforementioned payment methods or use the Security Plugin in version \u003e= 1.0.21.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"SwagPayPal payment not sent to PayPal correctly","id":"CVE-2023-23941","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"business_logic","year":"2023"},"n_packages":2,"n_references":2,"next":{"headline":"Self reflected HTML injection in Desktop client","id":"CVE-2023-23942"},"packages":[{"ecosystem":"Packagist","fixed":["5.4.4"],"introduced":["0"],"last_affected":[],"package":"swag/paypal","purl":null,"source":"GHSA-vxpm-8hcp-qh27"},{"ecosystem":"Packagist","fixed":["5.4.4"],"introduced":["0"],"last_affected":[],"package":"swag/paypal","purl":"pkg:composer/swag/paypal","source":"GHSA-vxpm-8hcp-qh27"}],"prev":{"headline":"OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass","id":"CVE-2023-23940"},"products":["SwagPayPal"],"published":"2023-02-03","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-03-10","vendors":["shopware"]},"summary":"Attackers can manipulate order amounts and item lists in PayPal checkout flows, leading to financial discrepancies in Shopware stores.","url":"https://insights.sbomify.com/CVE-2023-23941/"}