CVE-2004-1209: Verisign Payflow Link, when running with empty Accepted URL fields, does not properly verify the data in th...

Security readout for executives and security teams

This old CVE describes a payment checkout configuration weakness. If Verisign Payflow Link was used with empty Accepted URL fields, a buyer could alter the submitted AMOUNT value and potentially pay less than the intended item price. Exposure is most likely in legacy merchant checkout flows still using Verisign Payflow Link with empty Accepted URL fields. The provided affected-product metadata is incomplete, so inventory must confirm actual Payflow Link usage and configuration. Prioritize review if any revenue-generating checkout still uses Payflow Link. The business risk is direct underpayment or order fraud, but urgency depends on whether this legacy configuration is present. Mitigation focus: Review vendor or processor guidance for legacy Payflow Link configuration and fixes.; Ensure Payflow Link Accepted URL fields are not empty where the service remains used.; Validate order totals server-side against trusted catalog and cart data..

Prepared

Jun 30, 2026, 01:53 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.