Threats tagged 'ghsa-rc52-c4hv-w89p'

Sylius Mollie Plugin versions prior to 2.2.8, 3.2.4, and 3.3.1 contain an authorization bypass vulnerability in the payment webhook endpoint. The POST /{_locale}/update-payment endpoint accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the referenced Sylius order. This allows an unauthenticated attacker with any valid paid Mollie payment ID to mark a victim order as paid without transferring funds. The issue is fixed in versions 2.2.8, 3.2.4, and 3.3.1.