OpenMage magento-lts before 20.18.2 Payment Bypass via Free Payment Method
Summary
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via cart_...
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| OpenMagemagento-lts |
≥ 21.0.0-beta1, < 21.0.0-beta3→ 21.0.0-beta3 |
21.0.0-beta3 |
Original description The description as published by the source.
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via cart_payment.method while the total is zero, raise it with cart_coupon.remove, and submit cart.order to place an unpaid full-price order.
Source: CVE.org (CVE Program・cvelistV5) NVD