CVE-2020-8818

{"id": "CVE-2020-8818", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2020-02-25T02:15:12.097", "references": [{"url": "http://packetstormsecurity.com/files/156505/Magento-WooCommerce-CardGate-Payment-Gateway-2.0.30-Bypass.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://github.com/cardgate/magento2/blob/715979e54e1a335d78a8c5586f9e9987c3bf94fd/Controller/Payment/Callback.php#L88-L107", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/cardgate/magento2/issues/54", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-346"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or receive all of the subsequent payments."}, {"lang": "es", "value": "Se detect\u00f3 un problema en el plugin CardGate Payments versiones hasta 2.0.30 para Magento 2. Una falta de autenticaci\u00f3n de origen en la funci\u00f3n de procesamiento de una devoluci\u00f3n de llamada IPN en el archivo Controller/Payment/Callback.php, permite a un atacante reemplazar remotamente las configuraciones de plugin criticas (ID del comerciante, clave secreta , etc.) y, por lo tanto, omitir el proceso de pago (por ejemplo, falsificar el estado de un pedido enviando manualmente una petici\u00f3n de devoluci\u00f3n de llamada IPN con una firma v\u00e1lida pero sin pago real) y/o recibir todos los pagos posteriores."}], "lastModified": "2020-03-05T18:06:25.017", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cardgate:cardgate_payments:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7BD035FF-55DF-417A-99B2-8D6B574A8010", "versionEndIncluding": "2.0.30"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:magento:2.3.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13054AA9-B4EF-40F2-9768-C4C00F766D40"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}