Threats tagged 'ghsa-r5m2-xp8g-q8q6'

OpenMage magento-lts versions prior to 20.19.0 and 21.0.0-beta1 prior to 21.0.0-beta3 have a cross-site request forgery (CSRF) vulnerability in the PayPal cancel and decline return handlers. These handlers trust the checkout session without verifying that the request originated from PayPal. An attacker can exploit this by tricking a shopper into making a cross-site GET request to cancel their recent uninvoiced order, void pending authorizations, and restore items to the cart.