CVE-2021-41120

🗓️ 05 Oct 2021 21:15:09Reported by [email protected]Type

Sylius PayPal plugin in affected versions generates easily predictable URL for payment page after checkout due to autoincremented payment id. This leads to exposure of personally identifiable information as credit card form prefills "credit card holder" field with customer's name. The form does not require authentication, but the issue has been patched in versions 1.2.4 and 1.3.1. Workarounds include overriding route and changing URL parameters or modifying the template to add extra contingencies

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2021-41120	6 Oct 202100:30	–	circl
CNNVD	Sylius 信息泄露漏洞	5 Oct 202100:00	–	cnnvd
CNVD	Sylius Information Disclosure Vulnerability	1 Dec 202100:00	–	cnvd
CVE	CVE-2021-41120	5 Oct 202120:35	–	cve
Cvelist	CVE-2021-41120 Unauthorized access to Credit card form in sylius/paypal-plugin	5 Oct 202120:35	–	cvelist
EUVD	EUVD-2021-2137	7 Oct 202500:30	–	euvd
Github Security Blog	Sylius PayPal Plugin allows unauthorized access to Credit card form, exposing payer name and not requiring 3DS	6 Oct 202117:49	–	github
OSV	GHSA-25FX-MXC2-76G7 Sylius PayPal Plugin allows unauthorized access to Credit card form, exposing payer name and not requiring 3DS	6 Oct 202117:49	–	osv
Prion	Design/Logic Flaw	5 Oct 202121:15	–	prion
Positive Technologies	PT-2021-23103 · Sylius · Syliud Paypal Plugin	5 Oct 202100:00	–	ptsecurity

NVD

Node

sylius paypalRange1.0.0–1.2.4sylius

sylius paypalRange1.3.0–1.3.1sylius

Source	Link
github	www.github.com/Sylius/PayPalPlugin/commit/814923c2e9d97fe6279dcee866c34ced3d2fb7a7
github	www.github.com/Sylius/PayPalPlugin/security/advisories/GHSA-25fx-mxc2-76g7
github	www.github.com/Sylius/PayPalPlugin/commit/2adc46be2764ccee22b4247139b8056fb8d1afff

17 Jun 2026 04:07Current

CVSS 25

CVSS 3.17.5

EPSS0.01493