CVE-2017-6099: XSS
Cross-site scripting (XSS) vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK (aka merchant-sdk-php) 3.9.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter.
Other sources
Cross-site scripting (XSS) vulnerability in Paypal-Merchant-SDK-PHP
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/paypal/merchant-sdk-phpto a version that resolves this vulnerability.Fixed in 3.12.0
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6099?
CVE-2017-6099 is considered a medium severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2017-6099?
To remediate CVE-2017-6099, upgrade the PayPal PHP Merchant SDK to version 3.12.0 or later.
What is the impact of CVE-2017-6099?
CVE-2017-6099 allows remote attackers to inject arbitrary web scripts or HTML, potentially compromising user data.
Which versions are affected by CVE-2017-6099?
CVE-2017-6099 affects PayPal PHP Merchant SDK versions from 3.0.0 up to, but not including, 3.12.0.
Is CVE-2017-6099 a local or remote vulnerability?
CVE-2017-6099 is a remote vulnerability that can be exploited by attackers without local access.