CVE-2025-48445: Drupal Commerce Eurobank (Redirect) Incorrect Authorization Vulnerability
Summary
CVE-2025-48445: Drupal Commerce Eurobank (Redirect) Incorrect Authorization vulnerability. Affects drupal/commerce_eurobank_redirect versions < 2.1.1. Fixed in 2.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal Commerce Eurobank (Redirect) is a payment gateway integration for Drupal Commerce that facilitates transactions through Eurobank. It is designed to provide a seamless checkout experience for users, allowing merchants to accept payments securely. However, this package has been identified with an Incorrect Authorization vulnerability that can lead to functionality misuse, potentially compromising the security of transactions.
Vulnerability Detail
The Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) arises from inadequate access controls, allowing unauthorized users to perform actions that should be restricted. This vulnerability affects versions from 0.0.0 up to, but not including, 2.1.1. If exploited, it could lead to unauthorized access to sensitive transaction functionalities, resulting in financial loss or data breaches.
How To Fix
Minimum fixed version
2.1.1
This is the first release that contains the fix.
composer require drupal/commerce_eurobank_redirect:2.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the payment functionalities by implementing additional access control checks in your application until the package is updated. This may involve modifying user roles and permissions within your Drupal settings.
Conclusion
The Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) poses a significant risk to users and merchants. It is crucial to update to the latest version to mitigate this risk. Utilizing tools like Vulert can help maintain awareness of vulnerabilities in your open-source dependencies.
See every vulnerability recorded for drupal/commerce_eurobank_redirect →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized access to payment functionalities, resulting in financial loss and compromised user data.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just your composer.lock file.
If an immediate update is not possible, implement additional access controls and monitor your application closely for any suspicious activities.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/commerce_eurobank_redirect.
