DRUPAL-CONTRIB-2023-052
This module enables you to pay online via Mollie.
The module might not properly load the correct order to update the payment status when Mollie redirects to the redirect URL. This can allow an attacker to apply other people's orders to their own, getting credit without paying.
This vulnerability is mitigated by the fact that an attacker must have some knowledge about the module's internal functionality. The issue only affects installations that use the Mollie for Drupal Commerce submodule.
What each source reports
OSV No score
This module enables you to pay online via Mollie.
The module might not properly load the correct order to update the payment status when Mollie redirects to the redirect URL. This can allow an attacker to apply other people's orders to their own, getting credit without paying.
This vulnerability is mitigated by the fact that an attacker must have some knowledge about the module's internal functionality. The issue only affects installations that use the Mollie for Drupal Commerce submodule.
- Record
DRUPAL-CONTRIB-2023-052- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/molliePackagist:https://packages.drupal.org/8 |
before 2.2.1 | 2.2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2023-052 is a vulnerability with no CVSS score yet in drupal/mollie, published November 15, 2023. No source lists public exploit code. Fixed in drupal/mollie 2.2.1.