CyberRota Analysis
AI-GeneratedThe gopay library prior to version 1.5.119 is vulnerable due to the disabling of TLS certificate verification in its defaultClient() function, which exposes it to man-in-the-middle attacks. This flaw allows attackers to impersonate payment provider APIs, potentially leading to the theft of merchant credentials, signatures, and transaction data, as well as the ability to alter payment and refund responses. Organizations using gopay for payment processing should prioritize updating to the latest version to mitigate this critical security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment, refund and order query responses.