CVE-2023-23941CWE-345

SwagPayPal payment not sent to PayPal correctly

High · published February 3, 2023

CVSS v3.1
7.5
EPSS
0%
Percentile
21.3
In the wild
Unconfirmed
What it is

SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one in the created order. The problem has been fixed with version 5.4.4. As a workaround, disable the aforementioned payment methods or use the Security Plugin in version >= 1.0.21.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00297 · 21.3th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2023-02-03T20:26Z
EPSS history
Timeline
  • 03 FEB 20:26Z
    SwagPayPal payment not sent to PayPal correctly
    cvelistv5