CVE-2021-41120

{"id": "CVE-2021-41120", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-10-05T21:15:09.533", "references": [{"url": "https://github.com/Sylius/PayPalPlugin/commit/2adc46be2764ccee22b4247139b8056fb8d1afff", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Sylius/PayPalPlugin/commit/814923c2e9d97fe6279dcee866c34ced3d2fb7a7", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Sylius/PayPalPlugin/security/advisories/GHSA-25fx-mxc2-76g7", "tags": ["Mitigation", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-639"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after checkout was created with autoincremented payment id (/pay-with-paypal/{id}) and therefore it was easy to predict. The problem is that the Credit card form has prefilled \"credit card holder\" field with the Customer's first and last name and hence this can lead to personally identifiable information exposure. Additionally, the mentioned form did not require authentication. The problem has been patched in Sylius/PayPalPlugin 1.2.4 and 1.3.1. If users are unable to update they can override a sylius_paypal_plugin_pay_with_paypal_form route and change its URL parameters to (for example) {orderToken}/{paymentId}, then override the Sylius\\PayPalPlugin\\Controller\\PayWithPayPalFormAction service, to operate on the payment taken from the repository by these 2 values. It would also require usage of custom repository method. Additionally, one could override the @SyliusPayPalPlugin/payWithPaypal.html.twig template, to add contingencies: ['SCA_ALWAYS'] line in hostedFields.submit(...) function call (line 421). It would then have to be handled in the function callback."}, {"lang": "es", "value": "sylius/paypal-plugin es un plugin de paypal para la plataforma de desarrollo Sylius. En las versiones afectadas la URL a la p\u00e1gina de pago realizada tras el checkout es creada con el id de pago autoincrementado (/pay-with-paypal/{id}) y por tanto era f\u00e1cil de predecir. El problema es que el formulario de la tarjeta de cr\u00e9dito ha rellenado previamente el campo \"credit card holder\" con el nombre y los apellidos del cliente y, por tanto, esto puede conllevar a una exposici\u00f3n de informaci\u00f3n personal identificable. Adem\u00e1s, el mencionado formulario no requer\u00eda autenticaci\u00f3n. El problema ha sido parcheado en Sylius/PayPalPlugin versiones 1.2.4 y 1.3.1. Si los usuarios no pueden actualizar pueden anular una ruta sylius_paypal_plugin_pay_with_paypal_form y cambiar sus par\u00e1metros de URL a (por ejemplo) {orderToken}/{paymentId}, y luego anular el servicio SyliusPayPalPlugin\\Controller\\PayWithPayPalFormAction, para operar sobre el pago tomado del repositorio por estos 2 valores. Tambi\u00e9n requerir\u00eda el uso de un m\u00e9todo personalizado del repositorio. Adem\u00e1s, se podr\u00eda anular la plantilla @SyliusPayPalPlugin/payWithPaypal.html.twig, para a\u00f1adir contingencias: [\"SCA_ALWAYS\"] en la llamada a la funci\u00f3n hostedFields.submit(...) (l\u00ednea 421). Luego tendr\u00eda que ser manejado en el callback de la funci\u00f3n"}], "lastModified": "2022-08-12T16:49:13.457", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sylius:paypal:*:*:*:*:*:sylius:*:*", "vulnerable": true, "matchCriteriaId": "DB9AC068-FCB8-40EE-8462-8F8D1CD9DA8A", "versionEndExcluding": "1.2.4", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:sylius:paypal:*:*:*:*:*:sylius:*:*", "vulnerable": true, "matchCriteriaId": "21A0D473-2AC0-4649-BC1F-E74D4B6C111C", "versionEndExcluding": "1.3.1", "versionStartIncluding": "1.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}