CVE-2021-41274: Cross-Site Request Forgery (CSRF)

November 17, 2021 (updated November 24, 2021)

solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem.Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

References

github.com/solidusio/solidus_auth_devise/commit/731a6645e90ea9fd228f78ec53c6976c048a0555
github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
nvd.nist.gov/vuln/detail/CVE-2021-41274

Detect and mitigate CVE-2021-41274 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →