The Getnet Argentina para Woocommerce plugin for WordPress is vulnerable to authorization bypass due to missing validation on the 'webhook' function in versions up to, and including, 0.0.4. This makes it possible for unauthenticated attackers to set their payment status to 'APPROVED' without payment.
References
| Link | Resource |
|---|---|
| https://www.wordfence.com/threat-intel/vulnerabilities/id/245e9117-ca63-458e-a094-60a759f5ec19?source=cve | Third Party Advisory |
| https://www.youtube.com/watch?v=xTyWqh93AM0 | Exploit |
Configurations
Configuration 1 (hide)
|
History
07 Nov 2023, 04:18
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
19 Jul 2023, 18:25
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Getnet Argentina Para Woocommerce Project
Getnet Argentina Para Woocommerce Project getnet Argentina Para Woocommerce |
|
| CPE | cpe:2.3:a:getnet_argentina_para_woocommerce_project:getnet_argentina_para_woocommerce:*:*:*:*:*:wordpress:*:* | |
| References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/245e9117-ca63-458e-a094-60a759f5ec19?source=cve - Third Party Advisory | |
| References | (MISC) https://www.youtube.com/watch?v=xTyWqh93AM0 - Exploit |
12 Jul 2023, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-07-12 05:15
Updated : 2023-11-07 04:18
NVD link : CVE-2023-3525
Mitre link : CVE-2023-3525
JSON object : View
Products Affected
getnet_argentina_para_woocommerce_project
- getnet_argentina_para_woocommerce
CWE
No CWE.