Commerce Commonwealth (CBA) - Moderately Critical - Insufficient Verification of API Data - SA-CONTRIB-2015-136

This module enables you to pay for items on Drupal Commerce, using Commerce Commonwealth payment gateway.

The module doesn’t sufficiently validate the payment under certain specific scenarios. A malicious user can modify the urls used in gateway interaction with Commbank to make a failed payment appear to be a successful payment.

CVE identifier(s) issued

• CVE-2015-7231

Versions affected

• Commerce Commonwealth (CBA) 7.x-1.x versions prior to 7.x-1.5.

Drupal core is not affected. If you do not use the contributed Commerce Commonwealth (CBA) module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Commerce Commonwealth (CBA) module for Drupal 7.x, upgrade to Commerce Commonwealth (CBA) 7.x-1.5

Also see the Commerce Commonwealth (CBA) project page.

Reported by

• Greg Knaddison of the Drupal Security Team
• Michael Kandelaars
• John Avery

Fixed by

• John Avery the module maintainer
• Michael Kandelaars
• Greg Knaddison of the Drupal Security Team

Coordinated by

• Greg Knaddison of the Drupal Security Team