SA-CONTRIB-2015-072 - Commerce Ogone - Access bypass

This module enables you to use Ogone (Ingenico) as a payment method for Drupal Commerce.

Malicious users can trick Commerce Ogone into proceeding with the checkout process without actually going through the Ogone payment process, causing the order status to be set to checkout complete, even though no payment was processed.

The vulnerability is mitigated by the fact that the balance to be paid on affected orders remains the full amount, and no payment transaction is linked to the order.

CVE identifier(s) issued

• CVE-2015-4368

Versions affected

• Commerce Ogone 7.x-1.x versions prior to 7.x-1.5.

Drupal core is not affected. If you do not use the contributed Commerce Ogone module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Commerce Ogone module for Drupal 7.x, upgrade to Commerce Ogone 7.x-1.5

Also see the Commerce Ogone project page.

Reported by

• Mathieu Massebœuf

Fixed by

• Mathieu Massebœuf
• Ivo Van Geertruyen of the Drupal Security Team and module co-maintainer

Coordinated by

• Klaus Purer of the Drupal Security Team
• Greg Knaddison of the Drupal Security Team