Amazonpay V2 Plugin 4 0 4 1 Series
Monthly
Checkout-flow open redirection in the AmazonPay plugin for EC-CUBE 4 allows remote, unauthenticated attackers to send shoppers to an arbitrary external website during the ordering process, where the shopper's account information can be captured. Affected deployments are EC-CUBE 4-series stores running the AmazonPay v2 plugin (4.0/4.1 series, 4.2/4.3 series, and the 4.2/4.3 bundle edition) or the v1 plugin for the 4.0 series; stores without the plugin are unaffected. Rated CVSS 4.7 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N), there is no public exploit identified at time of analysis, and exploitation is not self-contained: it requires a victim shopper to be actively engaged in the order/checkout process and socially engineered into following the tampered flow, which limits both reach and reliability.
Checkout-flow open redirection in the AmazonPay plugin for EC-CUBE 4 allows remote, unauthenticated attackers to send shoppers to an arbitrary external website during the ordering process, where the shopper's account information can be captured. Affected deployments are EC-CUBE 4-series stores running the AmazonPay v2 plugin (4.0/4.1 series, 4.2/4.3 series, and the 4.2/4.3 bundle edition) or the v1 plugin for the 4.0 series; stores without the plugin are unaffected. Rated CVSS 4.7 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N), there is no public exploit identified at time of analysis, and exploitation is not self-contained: it requires a victim shopper to be actively engaged in the order/checkout process and socially engineered into following the tampered flow, which limits both reach and reliability.