CVE-2021-35060

MEDIUM 5.3CVE-2021-35060 · Published 11/10/2021 · updated 17/06/2026

In short

CVE-2021-35060 is a MEDIUM (CVSS 5.3) vulnerability affecting way4 (openwaygroup).
Chance of exploitation in the next 30 days (EPSS): 0.84%, higher than 57.9% of all vulnerabilities.
Fix: update to 1.2.278-2693 or later.

Package	Affected versions	Patched versions
way4 openwaygroup	`< 1.2.278-2693`	`1.2.278-2693`

Description

/way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response differences to discover whether a specific payment card number is stored in the system.

References

gist.github.com/exviry/9527ce2ccdc0718d3ffd1e3ca62cf304 · Third Party Advisory
openwaygroup.com/way4-platform · Product

More vulnerabilities in way4

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free