Vulnerability in Shopware Swagpaypal
CVE-2023-23941
SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one in the created order. The problem has been fixed with version 5.4.4. As a workaround, disable the aforementioned payment methods or use the Security Plugin in version >= 1.0.21.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.003 (20.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 20th percentile — 20.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Shopware Swagpaypal — versions < 5.4.4
Weakness classification (CWE)
References
- github.com/shopware/SwagPayPal/security/advisories/GHSA-vxpm-8hcp-qh27 (Third Party Advisory)
- github.com/shopware/SwagPayPal/commit/57db5f4a57ef0a1646b509b415de9f03bf441b08 (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2023-23941?
- CVE-2023-23941 is a high-severity vulnerability in Shopware Swagpaypal, classified under Insufficient Verification of Data Authenticity. CVSS score: 7.5/10. Published 2023-02-03.
- How severe is CVE-2023-23941?
- High severity. CVSS v3 base score is 7.5 out of 10.