{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c2.3.0"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/commerce_elavon"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c2.3.0"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/user/220112"
      ],
      "name": "Andy Fowlston"
    }
  ],
  "details": "This module enables you to accept payments from the Elavon payment provider.\n\nThe module doesn\u0027t sufficiently verify that it\u0027s communicating with the correct server when using the **Elavon (On-site)** payment gateway, which could lead to leaking valid payment details as well as accepting invalid payment details.\n\nThis vulnerability is mitigated by the fact that an attacker must be able to spoof the Elavon DNS received by your site.",
  "id": "DRUPAL-CONTRIB-2022-053",
  "modified": "2023-08-10T19:26:24.000Z",
  "published": "2022-08-24T18:21:02.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2022-053"
    }
  ],
  "schema_version": "1.7.0"
}