CVE-2014-10067: Improper Authentication

August 31, 2020 (updated September 23, 2021)

paypal-ipn before 3.0.0 uses the test_ipn parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox. With a bit of time, an attacker could craft a request using the simulator that would fool any application which does not explicitly check for test_ipn in production.

References

github.com/advisories/GHSA-h698-r4hm-w94p
github.com/andzdroid/paypal-ipn/issues/11
nodesecurity.io/advisories/26
nvd.nist.gov/vuln/detail/CVE-2014-10067
www.npmjs.com/advisories/26

Code Behaviors & Features

Detect and mitigate CVE-2014-10067 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →