CVE-2019-20455 : What You Need to Know

Heartland & Global Payments PHP SDK before version 2.0.0 allows SSL certificate validations to be bypassed in the Gateways/Gateway.php file.

Understanding CVE-2019-20455

The vulnerability in the Heartland & Global Payments PHP SDK could lead to SSL certificate validation bypass.

What is CVE-2019-20455?

The issue lies in the Gateways/Gateway.php file of the Heartland & Global Payments PHP SDK, where SSL certificate validations are not enforced.

The Impact of CVE-2019-20455

This vulnerability could potentially allow malicious actors to intercept sensitive data transmitted over insecure connections, leading to data breaches and unauthorized access.

Technical Details of CVE-2019-20455

The technical aspects of the CVE-2019-20455 vulnerability are as follows:

Vulnerability Description

The Heartland & Global Payments PHP SDK before version 2.0.0 fails to enforce SSL certificate validations in the Gateways/Gateway.php file.

Affected Systems and Versions

Affected Product: Heartland & Global Payments PHP SDK
Affected Version: Before 2.0.0

Exploitation Mechanism

By exploiting this vulnerability, attackers can intercept and manipulate data transmitted between the SDK and external servers due to the lack of SSL certificate validation.

Mitigation and Prevention

To address CVE-2019-20455 and enhance security measures, consider the following steps:

Immediate Steps to Take

Upgrade to version 2.0.0 or later of the Heartland & Global Payments PHP SDK to ensure SSL certificate validations are enforced.
Monitor network traffic for any suspicious activities that could indicate exploitation of the vulnerability.

Long-Term Security Practices

Implement secure coding practices to prevent similar vulnerabilities in future software releases.
Regularly update and patch software components to address known security issues.
Conduct security assessments and penetration testing to identify and remediate vulnerabilities proactively.

Patching and Updates

Ensure timely installation of security patches and updates provided by Heartland & Global Payments for the PHP SDK to mitigate the risk of SSL certificate validation bypass.