Project: 
Sagepay
Date: 
2018-January-31
Security risk: 
Critical 15∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All
Vulnerability: 
Access Bypass
Description: 

This module integrates the Sagepay payment service.

Some of the URLs used while processing the payment are not sufficiently secured. This might allow attackers to resume a previously failed payment attempt or to view content that should only be shown after a succesful payment. This affects all payments in a Drupal installation with this module enabled (including payments made using other payment methods).

Solution: 

Install the latest version:

Also see the Sagepay project page.

Reported By: 
Fixed By: 
Coordinated By: