Threats tagged 'ghsa-pgqw-7723-22rc'

OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contain a vulnerability where the 'free' payment method (which requires no payment information) can be exploited to place unpaid orders with a non-zero total. This occurs because the zero-total check is only performed when payment data is imported, allowing an API user with cart permissions to manipulate the cart and bypass payment requirements.