-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability centers on insufficient brute-force defenses in PayPal token exchange. Magento's PayPal IPN (Instant Payment Notification) system is a core component handling transaction verification. The execute() method in the IPN controller and processIpnRequest() in the model are critical points where token validation occurs. Without rate limiting or request throttling in these functions, attackers could spam forged IPN requests, overwhelming the system. This matches the described attack vector of abusing token exchange protocols to disrupt transactions. While exact patch details aren't available, these components are central to PayPal integration and align with the vulnerability's context.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.1.0, < 2.1.18 | 2.1.18 |
| magento/community-edition | composer | >= 2.2.0, < 2.2.9 | 2.2.9 |
| magento/community-edition | composer | >= 2.3.0, < 2.3.2 | 2.3.2 |