{"id":"CVE-2021-43846","published":"2021-12-20T21:30:11Z","modified":"2024-08-04T04:10:16Z","title":"CSRF forgery protection bypass for Spree::OrdersController#populate","vendor":"solidusio","product":"solidus","tier":"tail","description":{"text":"`solidus_frontend` is the cart and storefront for the Solidus e-commerce project. Versions of `solidus_frontend` prior to 3.1.5, 3.0.5, and 2.11.14 contain a cross-site request forgery (CSRF) vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. Versions 3.1.5, 3.0.5, and 2.11.14 contain a patch for this issue. The patch adds CSRF token verification to the \"Add to cart\" action. Adding forgery protection to a form that missed it can have some side effects. Other CSRF protection strategies as well as a workaround involving modifcation to config/application.rb` are available. More details on these mitigations are available in the GitHub Security Advisory.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00594,"percentile":0.48251,"provenance":"source"},"cwes":[{"id":"CWE-352","name":"Cross-Site Request Forgery"}],"references":[{"url":"https://github.com/solidusio/solidus/security/advisories/GHSA-h3fg-h5v3-vf8m","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/solidusio/solidus/commit/4d17cacf066d9492fc04eb3a0b16084b47376d81","tags":["x_refsource_MISC"]},{"url":"https://github.com/solidusio/solidus/commit/a1b9bf7f24f9b8684fc4d943eacb02b1926c77c6","tags":["x_refsource_MISC"]}],"priority":{"score":13.4,"factors":[{"name":"EPSS percentile","points":9.65},{"name":"CVSS severity","points":3.71}]},"vendorSlug":"solidusio","affectedVersions":[{"vendor":"solidusio","product":"solidus","versions":[">= 3.1.0, < 3.1.5",">= 3.0.0, < 3.0.5","< 2.11.14"]}],"affected":[{"ecosystem":"RubyGems","package":"solidus_frontend","vulnerableRanges":["<2.11.14",">=3.0.0, <3.0.5",">=3.1.0, <3.1.5"],"patched":["2.11.14","3.0.5","3.1.5"],"from":["GHSA-h3fg-h5v3-vf8m"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-0611","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-15109","published":"2020-08-04","fixed":"2.10.2","kev":false,"link":{"from":"CVE-2020-15109","to":"CVE-2021-43846","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:solidus_frontend","fromFixed":"2.10.2","toFixed":"2.11.14","daysApart":503}]}},{"cve":"CVE-2021-43846","published":"2021-12-20","fixed":"3.1.5","kev":false}],"package":"RubyGems:solidus_frontend"}}