CVE-2014-10067

State: Published
Severity: Not scored
Published: May 29, 2018
Updated: Sep 17, 2024
Reserved: Oct 29, 2017

Description

paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox. With a bit of time, an attacker could craft a request using the simulator that would fool any application which does not explicitly check for test_ipn in production.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
paypal-ipn node moduleHackerOne	<3.0.0Affected

References

https://github.com/andzdroid/paypal-ipn/issues/11
https://nodesecurity.io/advisories/26

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.