Ability to change order address without triggering address validations in solidus
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.
Summary
In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| solidusio | solidus | before 2.8.6; 2.9.0 to before 2.9.6; 2.10.0 to before 2.10.2 | 2.8.6, 2.9.6, 2.10.2 | Patch available | CNA |
| — | solidus_frontend (RubyGems) | before 2.8.6 | 2.8.6 | Patch available | GHSA-3mvg-rrrw-m7ph |
| — | solidus_frontend (RubyGems) | 2.9.0 to before 2.9.6 | 2.9.6 | Patch available | GHSA-3mvg-rrrw-m7ph |
| — | solidus_frontend (RubyGems) | 2.10.0 to before 2.10.2 | 2.10.2 | Patch available | GHSA-3mvg-rrrw-m7ph |
| — | solidus_api (RubyGems) | before 2.8.6 | 2.8.6 | Patch available | GHSA-3mvg-rrrw-m7ph |
| — | solidus_api (RubyGems) | 2.9.0 to before 2.9.6 | 2.9.6 | Patch available | GHSA-3mvg-rrrw-m7ph |
| — | solidus_api (RubyGems) | 2.10.0 to before 2.10.2 | 2.10.2 | Patch available | GHSA-3mvg-rrrw-m7ph |
- solidus Vendorsolidusio Affected before 2.8.6; 2.9.0 to before 2.9.6; 2.10.0 to before 2.10.2 Fixed in 2.8.6, 2.9.6, 2.10.2 Patch available CNA
- solidus_frontend (RubyGems) Vendor— Affected before 2.8.6 Fixed in 2.8.6 Patch available GHSA-3mvg-rrrw-m7ph
- solidus_frontend (RubyGems) Vendor— Affected 2.9.0 to before 2.9.6 Fixed in 2.9.6 Patch available GHSA-3mvg-rrrw-m7ph
- solidus_frontend (RubyGems) Vendor— Affected 2.10.0 to before 2.10.2 Fixed in 2.10.2 Patch available GHSA-3mvg-rrrw-m7ph
- solidus_api (RubyGems) Vendor— Affected before 2.8.6 Fixed in 2.8.6 Patch available GHSA-3mvg-rrrw-m7ph
- solidus_api (RubyGems) Vendor— Affected 2.9.0 to before 2.9.6 Fixed in 2.9.6 Patch available GHSA-3mvg-rrrw-m7ph
- solidus_api (RubyGems) Vendor— Affected 2.10.0 to before 2.10.2 Fixed in 2.10.2 Patch available GHSA-3mvg-rrrw-m7ph
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nebulab:solidus:*:*:*:*:*:*:*:* | before 2.8.6; 2.9.0 to before 2.9.6; 2.10.0 to before 2.10.2 | Vulnerable | solidusio |
- cpe:2.3:a:nebulab:solidus:*:*:*:*:*:*:*:* Versions before 2.8.6; 2.9.0 to before 2.9.6; 2.10.0 to before 2.10.2 Vulnerable ·solidusio
Remediation
- Fix · CNA solidus (solidusio) Fixed in 2.8.6, 2.9.6, 2.10.2
- Fix · GHSA-3mvg-rrrw-m7ph solidus_frontend (RubyGems) Fixed in 2.8.6 Advisory →
- Fix · GHSA-3mvg-rrrw-m7ph solidus_frontend (RubyGems) Fixed in 2.9.6 Advisory →
- Fix · GHSA-3mvg-rrrw-m7ph solidus_frontend (RubyGems) Fixed in 2.10.2 Advisory →
- Fix · GHSA-3mvg-rrrw-m7ph solidus_api (RubyGems) Fixed in 2.8.6 Advisory →
- Fix · GHSA-3mvg-rrrw-m7ph solidus_api (RubyGems) Fixed in 2.9.6 Advisory →
- Fix · GHSA-3mvg-rrrw-m7ph solidus_api (RubyGems) Fixed in 2.10.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15109
- 2026-10-03 Alias added: GHSA-3mvg-rrrw-m7ph
References
More solidusio Solidus vulnerabilities
- TI-2022-13046 CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend CVSS 3.1MEDIUM 4.3
- TI-2021-19611 ReDos vulnerability on guest checkout email validation CVSS 3.1HIGH 7.5
- TI-2021-19652 CSRF forgery protection bypass for Spree::OrdersController#populate CVSS 3.1MEDIUM 5.3
Sources
- CVE-2020-15109 · CVE Program
- CVE-2020-15109 · NVD
- FIRST EPSS
- GHSA-3mvg-rrrw-m7ph · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences