Uploaded image for project: 'CiviCRM'
  1. CiviCRM
  2. CRM-19106

When Contribution Transact API fails, unencrypted Credit Card Numbers are posted to logs.

    Details

    • Type: Security Advisory
    • Status: Done/Fixed
    • Priority: Major
    • Resolution: Duplicate
    • Affects Version/s: 4.6.19, 4.7.9
    • Fix Version/s: None
    • Component/s: CiviCRM API
    • Documentation Required?:
      None
    • Funding Source:
      Needs Funding

      Description

      While using Webforms with Drupal 7, CiviCRM 4.6.x, and Authorize.Net, I noticed that bad transactions are being dumped into the watchdog log. The Credit Card data is listed unencrypted and well labeled.

      Specifically this error occurred when a transaction was matched to a donor who was in the trash.

      Array ( [credit_card_number] => 12345678913 [cvv2] => 231
      [credit_card_type] => Credit Card [billing_first_name] => John [first_name] => John [billing_last_name] => Doe [last_name] => Doe [billing_street_address-5] => 123 11th Street NW [street_address] => 123 11th Street NW [billing_city-5] => Smallville [city] => Smallville [billing_country_id-5] => 1228 [country_id] => 1228 [billing_state_province_id-5] => 1040 [state_province_id] => 1040 [billing_postal_code-5] => 50010 [postal_code] => 50010 [year] => 2018 [month] => 3 [email] => john@gmail.com [contribution_page_id] => 2 [is_test] => 0 [payment_processor_id] => 1 [financial_type_id] => 2 [currencyID] => USD [currency] => USD [skipLineItem] => 1 [skipRecentView] => 1 [contact_id] => 14 [total_amount] => 100 [invoice_id] => 812345646548797986554321f [description] => Webform Payment: Join US! [source] => Register [submitted] => Array ( [contribution_pagebreak] => Payment [civicrm_1_contribution_1_contribution_payment_processor_id] => 1 [civicrm_1_contribution_1_contribution_contribution_page_id] => 2 ) [hidden_processor] => 1 [credit_card_exp_date] => Array ( [M] => 3 [Y] => 2018 ) [billing_middle_name] => [details] => Array ( [sid] => [page_num] => 4 [page_count] => 4 [finished] => 0 ) [form_build_id] => form-ZaHJ465465465468/84sdfd6UC4tk [form_id] => webform_client_form_1074 [op] => Submit [check_permissions] => [version] => 3

        Attachments

          Activity

            People

            • Assignee:
              colemanw Coleman Watts
              Reporter:
              TommyBobo Tommy Bobo
              Authorized Participants:
              Coleman Watts, Tim Otten Test
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: