View online: https://www.drupal.org/sa-contrib-2018-005
Project: Sagepay [1] Version: 7.x-1.4 Date: 2018-January-31 Security risk: *Critical* 15∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access Bypass
Description: This module integrates the Sagepay payment service.
Some of the URLs used while processing the payment are not sufficiently secured. This might allow attackers to resume a previously failed payment attempt or to view content that should only be shown after a succesful payment. This affects all payments in a Drupal installation with this module enabled (including payments made using other payment methods).
Solution: Install the latest version:
* If you use the sagepay_paymet module for Drupal 7.x, upgrade to sagepay_payment 7.x-1.5 [3]
Also see the Sagepay [4] project page.
Reported By: * Roman Zimmermann [5]
Fixed By: * Roman Zimmermann [6]
Coordinated By: * Greg Knaddison [7] of the Drupal Security Team
[1] https://www.drupal.org/project/sagepay_payment [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/sagepay_payment/releases/7.x-1.5 [4] https://www.drupal.org/project/sagepay_payment [5] https://www.drupal.org/u/torotil [6] https://www.drupal.org/u/torotil [7] https://www.drupal.org/u/greggles