Lucene search

[email protected]CVE-2023-23941

HistoryFeb 03, 2023 - 9:15 p.m.

CVE-2023-23941

2023-02-0321:15:11

CWE-345

[email protected]

web.nvd.nist.gov

cve

2023

23941

swagpaypal

paypal integration

shopware

platform

javascript

security

paypal plus

smart payment buttons

sepa

pay later

venmo

credit card

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

23.0%

JSON

SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one in the created order. The problem has been fixed with version 5.4.4. As a workaround, disable the aforementioned payment methods or use the Security Plugin in version >= 1.0.21.

Affected configurations

Vulners

NVD

Node

shopwareswagpaypalRange<5.4.4

VendorProductVersionCPE
shopwareswagpaypal*cpe:2.3:a:shopware:swagpaypal:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
shopware	swagpaypal	*	cpe:2.3:a:shopware:swagpaypal::::::::

CNA Affected

[
  {
    "vendor": "shopware",
    "product": "SwagPayPal",
    "versions": [
      {
        "version": "< 5.4.4",
        "status": "affected"
      }
    ]
  }
]