CVE-2022-29254

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

silverstripe-omnipay is a SilverStripe integration with Omnipay PHP payments library. For a subset of Omnipay gateways (those that use intermediary states like `isNotification()` or `isRedirect()`), if the payment identifier or success URL is exposed it is possible for payments to be prematurely marked as completed without payment being taken. This is mitigated by the fact that most payment gateways hide this information from users, however some issuing banks offer flawed 3DSecure implementations that may inadvertently expose this data. The following versions have been patched to fix this issue: `2.5.2`, `3.0.2`, `3.1.4`, and `3.2.1`. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-436

Affected software

No affected versions have been published.

Timeline

Published: Jun 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-292557.5Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract CVE-2022-292566.7sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only a CVE-2022-292577.2Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions pr CVE-2022-292586.1XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for CVE-2022-29264.9The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as ad CVE-2022-292626.7Improper buffer restrictions in some Intel(R) Server Board BIOS firmware may allow a privileged user to potentially enable escalation of pri CVE-2022-292637.8On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions pr CVE-2022-292649.8An issue was discovered in coreboot 4.13 through 4.16. On APs, arbitrary code execution in SMM may occur.CVE-2022-292657.5Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard CVE-2022-292667.5In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned CVE-2022-292696.5In Nagios XI through 5.8.5, in the schedule report function, an authenticated attacker is able to inject HTML tags that lead to the reformat CVE-2022-29279.8Weak Password Requirements in GitHub repository notrinos/notrinoserp prior to 0.7.