| Package | Affected versions | Patched versions |
|---|---|---|
| union pay | ≤ 1.2.0 |
Union Pay up to 1.2.0, for web based versions contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants' websites and mobile apps, via a crafted authentication code (MAC) which is generated based on a secret key which is NULL.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free