CVE-2018-19249: High severity Stripe Stripe API vulnerability

Published Jan 3, 2019

Updated

The Stripe API v1 allows remote attackers to bypass intended access restrictions by replaying api.stripe.com /v1/tokens XMLHttpRequest data, parsing the response under the object card{}, and reading the cvccheck information if the creation is successful without charging the actual card used in the transaction.

Affected Software

1 affected component

Stripe Stripe API=1.0

Event History

Jan 3, 2019

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-19249?

CVE-2018-19249 has a medium severity rating due to its potential for unauthorized access and information disclosure.

How do I fix CVE-2018-19249?

To mitigate CVE-2018-19249, upgrade to a patched version of the Stripe API that addresses the access control vulnerabilities.

What specific vulnerability does CVE-2018-19249 describe?

CVE-2018-19249 describes a vulnerability that allows remote attackers to bypass access restrictions by replaying API requests.

What are the consequences of exploiting CVE-2018-19249?

Exploitation of CVE-2018-19249 can lead to unauthorized access to sensitive card information, including cvc_check details.

Which version of the Stripe API is affected by CVE-2018-19249?

CVE-2018-19249 affects Stripe API version 1.0.