CVE-2020-23533

Union Pay up to 1.2.0, for web based versions contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants' websites and mobile apps, via a crafted authentication code (MAC) which is generated based on a secret key which is NULL.

• CWE-347

• http://mobitec.ie.cuhk.edu.hk/cve_2020/Permissions Required
• https://cwe.mitre.org/data/definitions/347.htmlTechnical Description
• https://www.dropbox.com/s/6smwnbrp0kgsgrc/poc_code.py?dl=0Third Party Advisory
• https://www.dropbox.com/s/czbkdr73tclq2nr/UnionPay_Vulnerability_Report.txt?dl=0Third Party Advisory
• http://mobitec.ie.cuhk.edu.hk/cve_2020/Permissions Required
• https://cwe.mitre.org/data/definitions/347.htmlTechnical Description
• https://www.dropbox.com/s/6smwnbrp0kgsgrc/poc_code.py?dl=0Third Party Advisory
• https://www.dropbox.com/s/czbkdr73tclq2nr/UnionPay_Vulnerability_Report.txt?dl=0Third Party Advisory

Published

Apr 6, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-23490There was a local file disclosure vulnerability in AVideo < …7.5
• CVE-2020-23512VR CAM P1 Model P1 v1 has an incorrect access control vulner…9.8
• CVE-2020-23517Cross Site Scripting (XSS) vulnerability in Aryanic HighMail…6.1
• CVE-2020-23518Cross Site Scripting (XSS) vulnerability in UltimateKode Neo…5.4
• CVE-2020-23520imcat 5.2 allows an authenticated file upload and consequent…7.2
• CVE-2020-23522Pixelimity 1.0 has cross-site request forgery via the admin/…6.8
• CVE-2020-23534A server-side request forgery (SSRF) vulnerability in Upgrad…9.8
• CVE-2020-23539An issue was discovered in Realtek rtl8723de BLE Stack <= 4.…7.5
• CVE-2020-23545IrfanView 4.54 allows a user-mode write access violation sta…7.8
• CVE-2020-23546IrfanView 4.54 allows attackers to cause a denial of service…7.8
• CVE-2020-23549IrfanView 4.54 allows attackers to cause a denial of service…7.8
• CVE-2020-23550IrfanView 4.54 allows a user-mode write access violation sta…7.8