Vulnerability Description
An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or receive all of the subsequent payments.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cardgate | Cardgate Payments | <= 2.0.30 |
| Adobe | Magento | 2.3.4 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/156505/Magento-WooCommerce-CardGate-PaymentExploitThird Party AdvisoryVDB Entry
- https://github.com/cardgate/magento2/blob/715979e54e1a335d78a8c5586f9e9987c3bf94ExploitThird Party Advisory
- https://github.com/cardgate/magento2/issues/54ExploitThird Party Advisory
- http://packetstormsecurity.com/files/156505/Magento-WooCommerce-CardGate-PaymentExploitThird Party AdvisoryVDB Entry
- https://github.com/cardgate/magento2/blob/715979e54e1a335d78a8c5586f9e9987c3bf94ExploitThird Party Advisory
- https://github.com/cardgate/magento2/issues/54ExploitThird Party Advisory
FAQ
What is CVE-2020-8818?
CVE-2020-8818 is a vulnerability with a CVSS score of 8.1 (HIGH). An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an...
How severe is CVE-2020-8818?
CVE-2020-8818 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-8818?
Check the references section above for vendor advisories and patch information. Affected products include: Cardgate Cardgate Payments, Adobe Magento.