CVE-2015-7231 The Commerce Commonwealth (CBA) module 7.x-1.x before 7.x-1.5 for Drupal does not properly validate payments, which allows remote attackers to make a failed payment appear valid via a crafted URL, rel...
MediumCVSS 5.0
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Commerce Commonwealth (CBA) module 7.x-1.x before 7.x-1.5 for Drupal does not properly validate payments, which allows remote attackers to make a failed payment appear valid via a crafted URL, related to a "response from commweb."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drupalcommerce commerce commonwealth | = 7.x-1.0 | No fix listed |
| drupalcommerce commerce commonwealth | = 7.x-1.1 | No fix listed |
| drupalcommerce commerce commonwealth | = 7.x-1.2 | No fix listed |
| drupalcommerce commerce commonwealth | = 7.x-1.3 | No fix listed |
| drupalcommerce commerce commonwealth | = 7.x-1.4 | No fix listed |
References
- www.drupal.org patch
- www.drupal.org patch vendor-advisory