Server side cross-site scripting In drupal/commerce_decoupled_checkout
Description
This module enables REST endpoints for a decoupled Commerce experience which allow for remote order creation.
The module doesn't sufficiently sanitize order data passed into the order creation endpoint, which allows for potentially unsafe order properties to be set on an order.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 packagist | 1.8.0 |
Aliases
1. 2. 3. 4. 5. 6.