CVE-2023-23941
High
Description
SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one in the created order. The problem has been fixed with version 5.4.4. As a workaround, disable the aforementioned payment methods or use the Security Plugin in version >= 1.0.21.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Shopware Swagpaypal
PublishedFeb 3, 2023
First seenFeb 3, 2023
Weakness typeCWE-345CWE-345
How to fix
Update
- shopware swagpaypal5.4.4 or later
- swag/paypal5.4.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| shopware swagpaypal | v < 5.4.4 | 5.4.4 |
| swag/paypalPackagist | v < 5.4.4 | 5.4.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.