Brian Willows

**Name of the Vulnerable Software and Affected Versions** Drupal Commerce CyberSource versions 0.0.0 through 1.10.0 **Description** An observable timing discrepancy in the Secure Acceptance Hosted Checkout gateway integration allows for brute force attacks. The module fails to correctly verify the integrity of data returned by the payment provider, which could enable an attacker to use a timing attack to trick the site into registering a payment as received when it has not been. **Recommendations** Update Drupal Commerce CyberSource to a version later than 1.10.0.

**Name of the Vulnerable Software and Affected Versions** Drupal Commerce Core versions 3.3.0 through 3.3.6 **Description** Stored Cross-site Scripting (XSS) occurs due to improper neutralization of input during web page generation. The module fails to sufficiently sanitize customer comments within the order receipt email template. This issue specifically affects installations where the `commerce checkout` module is enabled and the `customer comments` checkout pane is explicitly used, as this pane is disabled by default. **Recommendations** Update Drupal Commerce Core to a version later than 3.3.6. As a temporary mitigation, disable the `customer comments` checkout pane.