Commerce sermepa
The module does not check if a payment response actually belongs to the order it is being processed for. Anyone without logging in could cause an order to show the wrong payment status. They could change this data but could not uncover any hidden information.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youAny site using this module.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Commerce sermepa to 8.x-2.5.
For developers: what the fix changed
The fix validates the Redsys response signature before processing merchant parameters and ensures the received order ID matches the order being paid in `Sermepa::processRequest()`. It also adds `isPaidAmountValid()` to verify the paid amount and currency, and updates `SermepaForm::buildConfigurationForm()` to include the amount and order total in the signed merchant data.
src/Plugin/Commerce/PaymentGateway/Sermepa.php+101 −10 fixsrc/PluginForm/OffsiteRedirect/SermepaForm.php+5 −1 fix