CVE-2014-10067

2018-04-2600:00:00

hackerone

www.cve.org

0.001 Low

EPSS

Percentile

51.1%

JSON

paypal-ipn before 3.0.0 uses the test_ipn parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox. With a bit of time, an attacker could craft a request using the simulator that would fool any application which does not explicitly check for test_ipn in production.

CNA Affected

[
  {
    "product": "paypal-ipn node module",
    "vendor": "HackerOne",
    "versions": [
      {
        "status": "affected",
        "version": "<3.0.0"
      }
    ]
  }
]

References

github.com/andzdroid/paypal-ipn/issues/11

nodesecurity.io/advisories/26

0.001 Low

EPSS

Percentile

51.1%

JSON

Related for CVELIST:CVE-2014-10067