Commerce Decoupled Checkout
Monthly
Object injection in Drupal Commerce Decoupled Checkout before 1.8.0 can let remote, unauthenticated attackers manipulate dynamically determined object attributes when a victim interacts with the crafted request, with impact limited to integrity. The vendor has released 1.8.0 as the fix. No public exploit was identified at time of analysis, and EPSS is 0.42% (35th percentile).
Object injection in Drupal Commerce Decoupled Checkout before 1.8.0 can let remote, unauthenticated attackers manipulate dynamically determined object attributes when a victim interacts with the crafted request, with impact limited to integrity. The vendor has released 1.8.0 as the fix. No public exploit was identified at time of analysis, and EPSS is 0.42% (35th percentile).