DRUPAL-CONTRIB-2023-052 This module enables you to pay online via Mollie.
An attacker can manipulate payment status updates to apply other users' orders to their own, obtaining credit without paying.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is DRUPAL-CONTRIB-2023-052?
DRUPAL-CONTRIB-2023-052 is a vulnerability in drupal/mollie, published on 15 Nov 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
This module enables you to pay online via Mollie.
The module might not properly load the correct order to update the payment status when Mollie redirects to the redirect URL. This can allow an attacker to apply other people's orders to their own, getting credit without paying.
This vulnerability is mitigated by the fact that an attacker must have some knowledge about the module's internal functionality. The issue only affects installations that use the Mollie for Drupal Commerce submodule.
Which versions are affected by DRUPAL-CONTRIB-2023-052?
Linux distribution packages (1)
drupal/mollie Packagist:https://packages.drupal.org/8 | All versions | 2.2.1 |
How do I fix DRUPAL-CONTRIB-2023-052?
Upgrade to a fixed version.
Is DRUPAL-CONTRIB-2023-052 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2023-052 in the wild and no public exploit code.