{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c2.2.1"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/mollie"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c2.2.1"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/user/660798"
      ],
      "name": "Norbert Arends"
    },
    {
      "contact": [
        "https://www.drupal.org/user/1243726"
      ],
      "name": "Rico Van de Vin"
    }
  ],
  "details": "This module enables you to pay online via Mollie.\n\nThe module might not properly load the correct order to update the payment status when Mollie redirects to the redirect URL. This can allow an attacker to apply other people\u0027s orders to their own, getting credit without paying.\n\nThis vulnerability is mitigated by the fact that an attacker must have some knowledge about the module\u0027s internal functionality. The issue only affects installations that use the Mollie for Drupal Commerce submodule.",
  "id": "DRUPAL-CONTRIB-2023-052",
  "modified": "2023-11-15T17:19:15.000Z",
  "published": "2023-11-15T14:24:12.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2023-052"
    }
  ],
  "schema_version": "1.7.0"
}