What is CVE-2014-10067?

CVE-2014-10067 is a medium-severity vulnerability in Hackerone Paypal-Ipn Node Module, classified under Improper Authentication. CVSS score: 5.9/10. Published 2018-05-29.

How severe is CVE-2014-10067?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Auth bypass in Hackerone Paypal-Ipn Node Module

CVE-2014-10067

paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox. With a bit of time, an attacker could craft a request using the simulator that would fool any application which does not explicitly check for test_ipn in production.

Vulnerability class: Broken Authentication

EPSS: 0.012 (64.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Hackerone Paypal-ipn Node Module — versions <3.0.0
Paypal-ipn_project Paypal-ipn

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

support@hackerone.com (Third Party Advisory, x_refsource_MISC, Issue Tracking)
support@hackerone.com (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2014-10067?: CVE-2014-10067 is a medium-severity vulnerability in Hackerone Paypal-Ipn Node Module, classified under Improper Authentication. CVSS score: 5.9/10. Published 2018-05-29.
How severe is CVE-2014-10067?: Medium severity. CVSS v3 base score is 5.9 out of 10.