CVE-2021-43846
Description
`solidus_frontend` is the cart and storefront for the Solidus e-commerce project. Versions of `solidus_frontend` prior to 3.1.5, 3.0.5, and 2.11.14 contain a cross-site request forgery (CSRF) vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. Versions 3.1.5, 3.0.5, and 2.11.14 contain a patch for this issue. The patch adds CSRF token verification to the "Add to cart" action. Adding forgery protection to a form that missed it can have some side effects. Other CSRF protection strategies as well as a workaround involving modifcation to config/application.rb` are available. More details on these mitigations are available in the GitHub Security Advisory.
How to fix
- nebulab solidus2.11.14, 3.0.5, 3.1.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nebulab solidus | v < 2.11.14, 3.0.0 ≤ v < 3.0.5, 3.1.0 ≤ v < 3.1.5 | 2.11.14, 3.0.5, 3.1.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.