CVE-2021-41120

🗓️ 05 Oct 2021 20:35:10Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 55 Views🌐 WEB

sylius/paypal-plugin: Predictable Payment Page URL with PII Exposur

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2021-41120	6 Oct 202100:30	–	circl
CNNVD	Sylius 信息泄露漏洞	5 Oct 202100:00	–	cnnvd
CNVD	Sylius Information Disclosure Vulnerability	1 Dec 202100:00	–	cnvd
Cvelist	CVE-2021-41120 Unauthorized access to Credit card form in sylius/paypal-plugin	5 Oct 202120:35	–	cvelist
EUVD	EUVD-2021-2137	7 Oct 202500:30	–	euvd
Github Security Blog	Sylius PayPal Plugin allows unauthorized access to Credit card form, exposing payer name and not requiring 3DS	6 Oct 202117:49	–	github
NVD	CVE-2021-41120	5 Oct 202121:15	–	nvd
OSV	GHSA-25FX-MXC2-76G7 Sylius PayPal Plugin allows unauthorized access to Credit card form, exposing payer name and not requiring 3DS	6 Oct 202117:49	–	osv
Prion	Design/Logic Flaw	5 Oct 202121:15	–	prion
Positive Technologies	PT-2021-23103 · Sylius · Syliud Paypal Plugin	5 Oct 202100:00	–	ptsecurity

NVD

Vulners

Node

sylius paypalRange1.0.0–1.2.4sylius

sylius paypalRange1.3.0–1.3.1sylius

[
  {
    "product": "PayPalPlugin",
    "vendor": "Sylius",
    "versions": [
      {
        "status": "affected",
        "version": ">= 1.0.0, < 1.2.4"
      },
      {
        "status": "affected",
        "version": ">= 1.3.0, < 1.3.1"
      }
    ]
  }
]

Source	Link
github	www.github.com/Sylius/PayPalPlugin/commit/2adc46be2764ccee22b4247139b8056fb8d1afff
github	www.github.com/Sylius/PayPalPlugin/commit/814923c2e9d97fe6279dcee866c34ced3d2fb7a7
github	www.github.com/Sylius/PayPalPlugin/security/advisories/GHSA-25fx-mxc2-76g7

Parameter	Position	Path	Description	CWE
id	path	/pay-with-paypal/{id}	Predictable payment page URL due to autoincremented payment id enables exposure of PII via prefilled credit card holder field	CWE-200, CWE-639

21 Nov 2024 06:25Current

7.3High risk

Vulners AI Score7.3

CVSS 25

CVSS 3.17.5

EPSS0.00366