CyberRota Analysis
AI-GeneratedThe Sylius Mollie Plugin is vulnerable in versions prior to 2.2.8, 3.2.4, and 3.3.1, allowing unauthorized access to sensitive customer information through insecure endpoints that do not validate ownership or session. This flaw can lead to exposure of customer names and emails via predictable order IDs. Organizations using affected versions should prioritize updating to the fixed releases to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId values without ownership or session checks, exposing order tokenValue values that can be used with GET /{_locale}/register-after-checkout/{tokenValue} to view customer first name, last name, and email. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.