View online: https://www.drupal.org/sa-contrib-2018-005 Project: Sagepay [1] Version: 7.x-1.4 Date: 2018-January-31 Security risk: *Critical* 15∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access Bypass Description:  This module integrates the Sagepay payment service. Some of the URLs used while processing the payment are not sufficiently secured. This might allow attackers to resume a previously failed payment attempt or to view content that should only be shown after a succesful payment. This affects all payments in a Drupal installation with this module enabled (including payments made using other payment methods). Solution:  Install the latest version: * If you use the sagepay_paymet module for Drupal 7.x, upgrade to sagepay_payment 7.x-1.5 [3] Also see the Sagepay [4] project page. Reported By:  * Roman Zimmermann [5] Fixed By:  * Roman Zimmermann [6] Coordinated By:  * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/sagepay_payment [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/sagepay_payment/releases/7.x-1.5 [4] https://www.drupal.org/project/sagepay_payment [5] https://www.drupal.org/u/torotil [6] https://www.drupal.org/u/torotil [7] https://www.drupal.org/u/greggles