Threats affecting pkg:github/sylius/MolliePlugin

Sylius Mollie Plugin versions prior to 2.2.8, 3.2.4, and 3.3.1 contain an authorization bypass vulnerability. The plugin's endpoints for order redirection and QR code retrieval do not verify ownership or session, allowing unauthorized access to order token values. These tokens can be used to view customer personal information such as first name, last name, and email. The issue is addressed in versions 2.2.8, 3.2.4, and 3.3.1.

Sylius Mollie Plugin versions prior to 2.2.8, 3.2.4, and 3.3.1 contain an authorization bypass vulnerability in the payment webhook endpoint. The POST /{_locale}/update-payment endpoint accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the referenced Sylius order. This allows an unauthenticated attacker with any valid paid Mollie payment ID to mark a victim order as paid without transferring funds. The issue is fixed in versions 2.2.8, 3.2.4, and 3.3.1.