By Drupal Security Team on
  • Advisory ID: DRUPAL-SA-CONTRIB-2014-056
  • Project: Commerce Moneris (third-party module)
  • Version: 7.x
  • Date: 2014-May-21
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: Information Disclosure

Description

Commerce Moneris is a payment module that integrates the Moneris payment system with Drupal Commerce.

The module stores credit card data in a commerce order object unnecessarily for the purpose of passing the credit card information to the payment gateway. The credit card information is never removed from the order object and is later saved in the clear as serialized data in the database.

This vulnerability is mitigated by the fact that an attacker must have access to the database or the ability to execute PHP to output the raw or unserialized data from the commerce order.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.

Versions affected

  • Commerce Moneris 7.x-1.x versions prior to 7.x-1.4.

Drupal core is not affected. If you do not use the contributed Commerce Moneris module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Commerce Moneris project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.


Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity