Threats tagged 'ghsa-x83g-979r-f5fh'

Sylius Mollie Plugin versions prior to 2.2.8, 3.2.4, and 3.3.1 contain an authorization bypass vulnerability. The plugin's endpoints for order redirection and QR code retrieval do not verify ownership or session, allowing unauthorized access to order token values. These tokens can be used to view customer personal information such as first name, last name, and email. The issue is addressed in versions 2.2.8, 3.2.4, and 3.3.1.