What is CVE-2023-23941?

CVE-2023-23941 is a high-severity vulnerability in Shopware Swagpaypal, classified under Insufficient Verification of Data Authenticity. CVSS score: 7.5/10. Published 2023-02-03.

How severe is CVE-2023-23941?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Shopware Swagpaypal

CVE-2023-23941

SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one in the created order. The problem has been fixed with version 5.4.4. As a workaround, disable the aforementioned payment methods or use the Security Plugin in version >= 1.0.21.

EPSS: 0.003 (22.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Shopware Swagpaypal — versions < 5.4.4

Weakness classification (CWE)

CWE-345 — Insufficient Verification of Data Authenticity

References

security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2023-23941?: CVE-2023-23941 is a high-severity vulnerability in Shopware Swagpaypal, classified under Insufficient Verification of Data Authenticity. CVSS score: 7.5/10. Published 2023-02-03.
How severe is CVE-2023-23941?: High severity. CVSS v3 base score is 7.5 out of 10.