Brian Willows

The Mail Debug for WooCommerce WordPress plugin through 1.3.0 does not perform any capability, authentication, or nonce check on one of its email-logging actions, which is exposed to unauthenticated users and is not restricted to its own data, allowing anyone to read the full body of every email the site has sent, including password-reset emails whose reset key lets an attacker take over an administrator account.

P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in get check peer(). The received length (up to 255) was used to copy data into the 241-byte peer station name buffer and to place the terminating NUL byte, so a crafted block writes up to 15 bytes past the end of the buffer. This can lead to a crash (denial of service) or potentially arbitrary code execution. Requires establishment of session that needs ADJACENT network access.

A Cross-Site Request Forgery (CSRF) issue exists in the module used for Stripe Connect API integration. When redirecting to Stripe Connect to generate an authorization code, the module fails to include a CSRF token in the return URI. This allows an attacker to deceive an administrator into clicking a link that bypasses the payment process, resulting in orders being marked as paid without actual payment being processed.

Improper verification of cryptographic signatures in the module allows for signature spoofing. The issue occurs when a signing secret is not properly configured in the payment gateway settings, leading to insufficient verification of webhook event signatures. Webhooks are automated messages sent from Stripe to the application to notify it about events, such as successful payments.

Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS). This issue occurs when the module is used to configure the store via the Stripe Connect API. Exploitation requires the attacker to possess administrator permissions to configure payment gateways and the simultaneous compromise of an external service.

The Webform module, used for creating forms and processing submissions, contains a flaw in how it handles Remote Post handlers. These handlers send data to external servers via APIs. The module fails to sufficiently filter response values from the Remote Post handler before they are rendered through handler response tokens. Consequently, if a site uses these tokens in rendered output, a remote endpoint could return values that are rendered as HTML, leading to cross-site scripting (XSS), where malicious scripts are injected into trusted websites. Approximately 436,300 instances were identified globally.

An AJAX action available to unauthenticated users lacks authorization and authentication. Additionally, the plugin fails to verify the status of the requested post. This allows unauthenticated visitors to retrieve the title, content, or excerpt of arbitrary posts, including those that are private, draft, pending, trashed, or password-protected, leading to sensitive information exposure.

Insufficient sanitization and escaping of values submitted through the form widget allows unauthenticated attackers to inject arbitrary HTML into notification emails sent to the site administrator upon form submission.

The `miniorange saml` module fails to correctly restrict access to specific administrative functionality. This flaw allows unauthorized users to perform forceful browsing to access restricted features or modify configuration values intended only for privileged users.

This module enables a Drupal site to function as a SAML 2.0 Service Provider for external identity provider authentication. The issue occurs because the module fails to sufficiently sanitize certain values derived from SAML assertions before displaying them to users. This allows a malicious identity provider or an attacker capable of supplying crafted SAML attributes to execute cross-site scripting (XSS), which is a technique used to inject malicious scripts into web pages viewed by other users.

An authentication bypass issue exists where the module does not sufficiently prevent the reuse of previously accepted SAML assertions. This allows a valid assertion to be replayed within its validity period, potentially enabling remote services to perform repeated authentication attempts using stolen credentials.

This module enables a Drupal site to function as a SAML 2.0 Service Provider for external identity provider authentication. The issue occurs because the module does not sufficiently validate URLs obtained from identity provider metadata. An attacker with permissions to configure this metadata could force the application to send requests to unintended destinations, potentially granting access to internal network resources. This is a Server-Side Request Forgery (SSRF), which is a flaw that allows an attacker to induce the server-side application to make requests to an arbitrary domain.

An observable timing discrepancy in the Secure Acceptance Hosted Checkout gateway integration allows for brute force attacks. The module fails to correctly verify the integrity of data returned by the payment provider, which could enable an attacker to use a timing attack to trick the site into registering a payment as received when it has not been.

Stored Cross-site Scripting (XSS) occurs due to improper neutralization of input during web page generation. The module fails to sufficiently sanitize customer comments within the order receipt email template. This issue specifically affects installations where the `commerce checkout` module is enabled and the `customer comments` checkout pane is explicitly used, as this pane is disabled by default.