Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

paypal-ipn

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.9npmAmendedPublished

    Validation Bypass in paypal-ipn

    CVE-2014-10067 · GHSA-h698-r4hm-w94p

    Affected
    • npm paypal-ipn < 3.0.0
    Fixed in
    3.0.0· Vendor fix available
    Issue
    Versions 2.x.x and earlier of paypal-ipn are affected by a validation bypass vulnerability. paypal-ipn uses the testipn parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox. A motivated attacker could craft a request string using the simulator to fool the application into entering the sandbox mode, potentially allowing purchases without valid payment. Recommendation Upgrade to version 3.0.0 or later.

    Recommended action: Upgrade to 3.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →