CVE-2012-2991 : The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remo

The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.

Published 2012-09-19 19:55:05

Updated 2013-03-02 04:42:58

Source CERT/CC

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2012-2991

EPSS FAQ

0.21%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 59 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2012-2991

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

Products affected by CVE-2012-2991

Oscommerce » Online Merchant
Versions up to, including, (<=) 2.3.3
cpe:2.3:a:oscommerce:online_merchant:*:*:*:*:*:*:*:*
Matching versions
Oscommerce » Online Merchant » Version: 2.3.0
cpe:2.3:a:oscommerce:online_merchant:2.3.0:*:*:*:*:*:*:*
Matching versions
Oscommerce » Online Merchant » Version: 2.3.1
cpe:2.3:a:oscommerce:online_merchant:2.3.1:*:*:*:*:*:*:*
Matching versions
Oscommerce » Online Merchant » Version: 2.3.2
cpe:2.3:a:oscommerce:online_merchant:2.3.2:*:*:*:*:*:*:*
Matching versions
Paypal » Website Payments Standard Module
Versions up to, including, (<=) 1.0
cpe:2.3:a:paypal:website_payments_standard_module:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2012-2991

Exploit prediction scoring system (EPSS) score for CVE-2012-2991

CVSS scores for CVE-2012-2991

References for CVE-2012-2991

Products affected by CVE-2012-2991