CVE-2021-43846

Cross-Site Request Forgery (CSRF) in gem/solidus_frontend

Identifiers

CVE-2021-43846, GHSA-h3fg-h5v3-vf8m

Package Slug

gem/solidus_frontend

Vulnerability

Cross-Site Request Forgery (CSRF)

Description

solidus_frontend is the cart and storefront for the Solidus e-commerce project. Versions of solidus_frontend contain a cross-site request forgery (CSRF) vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. contain a patch for this issue. The patch adds CSRF token verification to the "Add to cart" action. Adding forgery protection to a form that missed it can have some side effects. Other CSRF protection strategies as well as a workaround involving modifcation to config/application.rb` are available. More details on these mitigations are available in the GitHub Security Advisory.

Affected Versions

All versions before 2.11.14, all versions starting from 3.0.0 before 3.0.5, all versions starting from 3.1.0 before 3.1.5

Solution

Upgrade to versions 2.11.14, 3.0.5, 3.1.5 or above.

Last Modified

2022-01-04

source