Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWg2OTgtcjRobS13OTRw

Validation Bypass in paypal-ipn

Versions 2.x.x and earlier of paypal-ipn are affected by a validation bypass vulnerability.

paypal-ipn uses the test_ipn parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox.

A motivated attacker could craft a request string using the simulator to fool the application into entering the sandbox mode, potentially allowing purchases without valid payment.

Recommendation

Upgrade to version 3.0.0 or later.

Permalink: https://github.com/advisories/GHSA-h698-r4hm-w94p
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWg2OTgtcjRobS13OTRw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 4 years ago
Updated: about 2 years ago

CVSS Score: 5.9
CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Percentage: 0.00148
EPSS Percentile: 0.5153

Identifiers: GHSA-h698-r4hm-w94p, CVE-2014-10067
References:

• https://github.com/andzdroid/paypal-ipn/issues/11
• https://www.npmjs.com/advisories/26
• https://nvd.nist.gov/vuln/detail/CVE-2014-10067
• https://github.com/advisories/GHSA-h698-r4hm-w94p

Repository: https://github.com/andzdroid/paypal-ipn
Blast Radius: 10.8

Affected Packages