Yüksek CVSS 7.5
CVE-2026-119037: CVE-2026-119037: güvenlik açığı
Açıklama (NVD)
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read from an unset environment variable, or an empty entry in a list of rotated secrets, is used as is. A remote attacker can sign a forged webhook with an empty key and have it accepted as sent by GoCardless.
Özet bilgiler
- CVSS v3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS
- %0,12 (yüzdelik 2)
- CWE
- CWE-347
- Yama
- Yok / bilinmiyor