Commerce Eurobank Redirect EUVD-2025-18125

The CVSS v3.1 score of 8.8 reflects high severity: Network-accessible (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), but requires user interaction (UI:R). The UI:R requirement suggests an attacker must trick a user into clicking a malicious link or visiting a crafted page, slightly reducing real-world exploitability compared to pure unauthenticated RCE. However, the High impact ratings for confidentiality (payment data exposure), integrity (transaction manipulation), and availability (service disruption) indicate severe business consequences. Without explicit KEV or EPSS data provided, the risk assessment relies on the vector analysis: this is a legitimate critical vulnerability affecting financial transactions. The lack of authentication requirement combined with payment processing functionality creates substantial real-world risk, particularly for e-commerce sites processing real transactions. Organizations using affected versions should prioritize patching given the payment-processing context and demonstrated authorization flaw.

An attacker crafts a malicious URL or email containing a specially crafted payment redirect link that bypasses authorization checks in the Eurobank callback handler. A victim (e-commerce customer or site administrator) clicks the link while authenticated to the Drupal site. The vulnerability allows the attacker to: (1) view sensitive payment/transaction data they should not access; (2) modify transaction parameters (e.g., amount, recipient); or (3) complete unauthorized payment transactions. Because the vulnerability requires UI interaction but no attacker authentication, a realistic attack involves phishing emails with links like 'Complete your payment' or social engineering victims to click malicious redirect URLs. In a multi-user e-commerce environment, an attacker could exploit this against customer sessions to perform fraudulent transactions or extract PII bundled with payment processing.