[Security-news] Sagepay - Critical - Access Bypass - SA-CONTRIB-2018-005

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2018-005

Project: Sagepay [1]
Version: 7.x-1.4
Date: 2018-January-31
Security risk: *Critical* 15∕25
AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2]
Vulnerability: Access Bypass

Description: 
This module integrates the Sagepay payment service.

Some of the URLs used while processing the payment are not sufficiently
secured. This might allow attackers to resume a previously failed payment
attempt or to view content that should only be shown after a succesful
payment. This affects all payments in a Drupal installation with this module
enabled (including payments made using other payment methods).

Solution: 
Install the latest version:

   * If you use the sagepay_paymet module for Drupal 7.x, upgrade to
     sagepay_payment 7.x-1.5 [3]

Also see the Sagepay [4] project page.

Reported By: 
   * Roman Zimmermann [5]

Fixed By: 
   * Roman Zimmermann [6]

Coordinated By: 
   * Greg Knaddison [7] of the Drupal Security Team


[1] https://www.drupal.org/project/sagepay_payment
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/sagepay_payment/releases/7.x-1.5
[4] https://www.drupal.org/project/sagepay_payment
[5] https://www.drupal.org/u/torotil
[6] https://www.drupal.org/u/torotil
[7] https://www.drupal.org/u/greggles