Threats tagged 'ghsa-mr9r-h354-966r'

Sylius versions prior to 2.0.18, 2.1.15, and 2.2.6 contain an Insecure Direct Object Reference (IDOR) vulnerability in the Shop Payment Request API endpoints. The GET and PUT endpoints for payment requests identify resources solely by a UUID hash without verifying ownership by the authenticated user. This allows an attacker who obtains a payment request hash to read sensitive order information and modify payment request redirect URLs to attacker-controlled destinations. The POST endpoint for creating payment requests similarly lacks ownership verification. The vulnerability requires obtaining the UUID hash out-of-band but does not require further authentication once the hash is known. Official patches are available in the fixed versions. A workaround involves adding query extensions to enforce ownership checks on payment request access.