Union Pay up to 1.2.0, for web based versions contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants websites and mobile apps, via a crafted authentication code (MAC) which is generated based on a secret key which is NULL.
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Union_pay | Unionpayintl | * | 1.2.0 (including) |