Lucene search

MitreCVE-2020-8818

HistoryFeb 25, 2020 - 2:15 a.m.

CVE-2020-8818

2020-02-2502:15:12

CWE-346

mitre

web.nvd.nist.gov

118

cardgate payments

magento 2

cve-2020-8818

security vulnerability

ipn callback

origin authentication

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

High

EPSS

0.108

Percentile

95.1%

JSON

An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or receive all of the subsequent payments.

Affected configurations

Nvd

Node

cardgatecardgate_paymentsRange≤2.0.30

Node

adobemagentoMatch2.3.4

VendorProductVersionCPE
cardgatecardgate_payments*cpe:2.3:a:cardgate:cardgate_payments:*:*:*:*:*:*:*:*
adobemagento2.3.4cpe:2.3:a:adobe:magento:2.3.4:*:*:*:*:*:*:*