CVE-2023-23941: Payment information sent to PayPal not necessarily identical to created order
Impact If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one in the created order.
Patches The problem has been fixed with version 5.4.4
Workarounds Disable the aforementioned payment methods or use the Security Plugin in version >= 1.0.21.
References Shopware blog post
Other sources
Payment information sent to PayPal not necessarily identical to created order
— Packagist
SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one in the created order. The problem has been fixed with version 5.4.4. As a workaround, disable the aforementioned payment methods or use the Security Plugin in version >= 1.0.21.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/swag/paypalto a version that resolves this vulnerability.Fixed in 5.4.4 - Upgrade
Upgrade
SwagPayPalto a version that resolves this vulnerability.Fixed in 5.4.4 - Upgrade
Upgrade
Security Pluginto a version that resolves this vulnerability.Fixed in 1.0.21 - Configuration
Disable PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, and Credit card payment methods.
SwagPayPal PayPal payment methods = disabled
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-23941.
What is the severity of CVE-2023-23941?
The severity of CVE-2023-23941 is high with a severity value of 7.5.
What is the affected software for CVE-2023-23941?
The affected software for CVE-2023-23941 is Shopware Swagpaypal up to version 5.4.4.
How can I fix CVE-2023-23941 vulnerability?
To fix the CVE-2023-23941 vulnerability, update your Shopware Swagpaypal installation to a version beyond 5.4.4.
Where can I find more information about CVE-2023-23941?
You can find more information about CVE-2023-23941 in the GitHub commit and security advisories provided by Shopware SwagPayPal.