CVE-2021-41120
1 advisory.
Packagist/sylius/paypal-plugin CVE-2021-41120: high 7.5, EPSS 1.54%
Sylius PayPal Plugin allows unauthorized access to Credit card form, exposing payer name and not requiring 3DS
Action: Upgrade sylius/paypal-plugin to 1.2.4 or later.
composer require sylius/paypal-plugin:1.2.4composer require sylius/paypal-plugin:1.3.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0.0 | 1.2.4 | - |
| 1.3.0 | 1.3.1 | - |
Fixed versions
| 1.2.4 | 1.3.1 |
Sources
- osv: GHSA-25fx-mxc2-76g7
- https://github.com/Sylius/PayPalPlugin/security/advisories/GHSA-25fx-mxc2-76g7
- https://nvd.nist.gov/vuln/detail/CVE-2021-41120
- https://github.com/Sylius/PayPalPlugin/commit/2adc46be2764ccee22b4247139b8056fb8d1afff
- https://github.com/Sylius/PayPalPlugin/commit/814923c2e9d97fe6279dcee866c34ced3d2fb7a7
- https://github.com/Sylius/PayPalPlugin
CVE-2021-41120 · published · modified · JSON