CVE-2015-7231

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

The Commerce Commonwealth (CBA) module 7.x-1.x before 7.x-1.5 for Drupal does not properly validate payments, which allows remote attackers to make a failed payment appear valid via a crafted URL, related to a "response from commweb."

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.drupal.org/node/2541832Patch
https://www.drupal.org/node/2542380Patch, Vendor Advisory
https://www.drupal.org/node/2541832Patch
https://www.drupal.org/node/2542380Patch, Vendor Advisory

Timeline

Published: Sep 17, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-72322.6Cross-site scripting (XSS) vulnerability in unspecified administration pages in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the O CVE-2015-72335.1Cross-site request forgery (CSRF) vulnerability in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Import module is enabled, CVE-2015-72344.0The OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology and OSF Import modules are enabled, allows user-assisted remote atta CVE-2015-72357.5Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote CVE-2015-72367.5Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of CVE-2015-72375.0Directory traversal vulnerability in the remote log viewing functionality in McAfee Agent (MA) 5.x before 5.0.2 allows remote attackers to o CVE-2015-72382.1The Secondary server in Threat Intelligence Exchange (TIE) before 1.2.0 uses weak permissions for unspecified (1) configuration files and (2 CVE-2015-72397.5SQL injection vulnerability in the BP_FIND_JOBS_WITH_PROGRAM function module in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to ex CVE-2015-72419.8XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.CVE-2015-72426.1Cross-site scripting (XSS) vulnerability in the Push-Service-Mails feature in AVM FRITZ!OS before 6.30 allows remote attackers to inject arb CVE-2015-72437.5Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary c CVE-2015-72447.5The default configuration of the server in MobaXterm before 8.3 has a disabled Access Control setting and consequently does not require auth