CVE-2023-23941 json
SwagPayPal payment not sent to PayPal correctly
published 2023-02-03 3 y ago modified 2026-09-10 1 mo ago also GHSA-vxpm-8hcp-qh27 , EUVD-2023-0805
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 22%
- public exploits
- 0
- none known
Summary
SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one in the created order. The problem has been fixed with version 5.4.4. As a workaround, disable the aforementioned payment methods or use the Security Plugin in version >= 1.0.21.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 20 mo ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | swag/paypal | <5.4.4 |
5.4.4 |
Affected products
- shopware SwagPayPal
Classification
- Weakness
-
- CWE-345 Insufficient Verification of Data Authenticity
References
-
github.com
/shopware/SwagPayPal/commit/57db5f4a57ef0a1646b509b415de9f03bf441b08
web, patch, third-party-advisory
-
github.com
/shopware/SwagPayPal/security/advisories/GHSA-vxpm-8hcp-qh27
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-23941
advisory
-
github.com
/shopware/SwagPayPal
package
Sources
- CVE List CVE-2023-23941
- GitHub Advisory GHSA-vxpm-8hcp-qh27
- NVD CVE-2023-23941
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.