OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders…
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via cart_payment.method while the total is zero, raise it with cart_coupon.remove, and submit cart.order to place an unpaid full-price order.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- OpenMage
- Product
- magento-lts
- CVSS v3.1
- 4.4 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
- Weakness
- CWE-841
- NVD status
- Received
Why it ranks 18 (Routine)
- CVSS v3.1 4.4 medium
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.