Vulnerability in Silverstripe Silverstripe-Omnipay
CVE-2022-29254
silverstripe-omnipay is a SilverStripe integration with Omnipay PHP payments library. For a subset of Omnipay gateways (those that use intermediary states like `isNotification()` or `isRedirect()`), if the payment identifier or success URL is exposed it is possible for payments to be prematurely marked as completed without payment being taken. This is mitigated by the fact that most payment gateways hide this information from users, however some issuing banks offer flawed 3DSecure implementations that may inadvertently expose this data. The following versions have been patched to fix this issue: `2.5.2`, `3.0.2`, `3.1.4`, and `3.2.1`. There are no known workarounds for this vulnerability.
EPSS: 0.006 (46.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Silverstripe Silverstripe-omnipay — versions < 2.5.2, >= 3.0.0, < 3.0.2, >= 3.1.0, < 3.1.4
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2022-29254?
- CVE-2022-29254 is a low-severity vulnerability in Silverstripe Silverstripe-Omnipay, classified under CWE-436. CVSS score: 3.7/10. Published 2022-06-09.
- How severe is CVE-2022-29254?
- Low severity. CVSS v3 base score is 3.7 out of 10.