Back to Database
Status published
High
CVE-2018-19249
The Stripe API v1 allows remote attackers to bypass intended...
Vulnerability Description
The Stripe API v1 allows remote attackers to bypass intended access restrictions by replaying api.stripe.com /v1/tokens XMLHttpRequest data, parsing the response under the object card{}, and reading the cvc_check information if the creation is successful without charging the actual card used in the transaction.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-19249
Credits & Attribution
No credits recorded in the NVD database.
References
More from stripe
View All →CVE-2024-45401
stripe-cli Path Traversal vulnerability
High
7.6
CVE-2022-29188
Smokescreen SSRF via deny list bypass (square brackets) in Smokescreen
Medium
5.3
CVE-2022-24825
Smokescreen SSRF via deny list bypass
Medium
5.8
CVE-2022-24753
Code injection in Stripe CLI on windows
High
7.7
CVE-2021-21420
Vulnerability in Stripe for Visual Studio Code < 1.7.3
High
7.5
Affected Vendor
stripe
View all reports →Affected Software
stripe api
Vulnerable Versions:
1.0
Timeline
Official Publish:
January 3rd, 2019
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.