CVE-2022-29254

silverstripe-omnipay is a SilverStripe integration with Omnipay PHP payments library. For a subset of Omnipay gateways (those that use intermediary states like `isNotification()` or `isRedirect()`), if the payment identifier or success URL is exposed it is possible for payments to be prematurely marked as completed without payment being taken. This is mitigated by the fact that most payment gateways hide this information from users, however some issuing banks offer flawed 3DSecure implementations that may inadvertently expose this data. The following versions have been patched to fix this issue: `2.5.2`, `3.0.2`, `3.1.4`, and `3.2.1`. There are no known workarounds for this vulnerability.

• CWE-436

• https://github.com/silverstripe/silverstripe-omnipay/commit/7dee9a1e0a5f54c2dc06e018cff3d9a19044e01bPatch, Third Party Advisory
• https://github.com/silverstripe/silverstripe-omnipay/security/advisories/GHSA-48f2-m7jg-866xThird Party Advisory
• https://github.com/silverstripe/silverstripe-omnipay/commit/7dee9a1e0a5f54c2dc06e018cff3d9a19044e01bPatch, Third Party Advisory
• https://github.com/silverstripe/silverstripe-omnipay/security/advisories/GHSA-48f2-m7jg-866xThird Party Advisory

Published

Jun 9, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29249JavaEZ is a library that adds new functions to make Java eas…7.5
• CVE-2022-2925Cross-site Scripting (XSS) - Stored in GitHub repository app…5.4
• CVE-2022-29250GLPI is a Free Asset and IT Management Software package, tha…6.5
• CVE-2022-29251XWiki Platform Flamingo Theme UI is a tool that allows custo…6.1
• CVE-2022-29252XWiki Platform Wiki UI Main Wiki is a package for managing s…6.1
• CVE-2022-29253XWiki Platform is a generic wiki platform offering runtime s…2.7
• CVE-2022-29255Vyper is a Pythonic Smart Contract Language for the ethereum…7.5
• CVE-2022-29256sharp is an application for Node.js image processing. Prior …6.7
• CVE-2022-29257Electron is a framework for writing cross-platform desktop a…7.2
• CVE-2022-29258XWiki Platform Filter UI provides a generic user interface t…6.1
• CVE-2022-2926The Download Manager WordPress plugin before 3.2.55 does not…4.9
• CVE-2022-29262Improper buffer restrictions in some Intel(R) Server Board B…6.7