CVE-2019-14978: Input Validation
First published: Thu Aug 29 2019(Updated: )
/payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuantity=1 parameter, as demonstrated by purchasing an item for lower than the intended price.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Woocommerce Payu India Payment Gateway | =2.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-14978?
CVE-2019-14978 is a vulnerability in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress that allows parameter tampering in the purchaseQuantity parameter.
How does CVE-2019-14978 affect the plugin?
CVE-2019-14978 affects the WooCommerce PayU India Payment Gateway plugin version 2.1.1 for WordPress.
What is the severity of CVE-2019-14978?
CVE-2019-14978 has a severity score of 5.3 out of 10, indicating a medium severity.
How can I exploit CVE-2019-14978?
To exploit CVE-2019-14978, you would need to tamper with the purchaseQuantity parameter to purchase an item for a lower price than intended.
Is there a fix for CVE-2019-14978?
A fix for CVE-2019-14978 may be available from the plugin vendor or developer, and it is recommended to update to the latest version of the WooCommerce PayU India Payment Gateway plugin to address this vulnerability.
- collector/nvd-index
- agent/severity
- agent/author
- agent/references
- agent/weakness
- agent/description
- agent/type
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/woocommerce
- canonical/woocommerce payu india payment gateway
- version/woocommerce payu india payment gateway/2.1.1