TI-2021-19652 Aliases CVE-2021-43846 GHSA-h3fg-h5v3-vf8m

CSRF forgery protection bypass for Spree::OrdersController#populate

LOW 25CWE-352Published 2021-12-20 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

`solidus_frontend` is the cart and storefront for the Solidus e-commerce project. Versions of `solidus_frontend` prior to 3.1.5, 3.0.5, and 2.11.14 contain a cross-site request forgery (CSRF) vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. Versions 3.1.5, 3.0.5, and 2.11.14 contain a patch for this issue. The patch adds CSRF token verification to the "Add to cart" action. Adding forgery protection to a form that missed it can have some side effects. Other CSRF protection strategies as well as a workaround involving modifcation to config/application.rb` are available. More details on these mitigations are available in the GitHub Security Advisory.

Why it matters now

EPSS 0.00594 48th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed solidus (solidusio): 3.1.5, 3.0.5, 2.11.14solidus_frontend (RubyGems): 2.11.14, 3.0.5, 3.1.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
solidusio	solidus	3.1.0 to before 3.1.5; 3.0.0 to before 3.0.5; before 2.11.14	3.1.5, 3.0.5, 2.11.14	Patch available	CNA
—	solidus_frontend (RubyGems)	before 2.11.14	2.11.14	Patch available	GHSA-h3fg-h5v3-vf8m
—	solidus_frontend (RubyGems)	3.0.0 to before 3.0.5	3.0.5	Patch available	GHSA-h3fg-h5v3-vf8m
—	solidus_frontend (RubyGems)	3.1.0 to before 3.1.5	3.1.5	Patch available	GHSA-h3fg-h5v3-vf8m

solidus Vendorsolidusio Affected 3.1.0 to before 3.1.5; 3.0.0 to before 3.0.5; before 2.11.14 Fixed in 3.1.5, 3.0.5, 2.11.14 Patch available CNA
solidus_frontend (RubyGems) Vendor— Affected before 2.11.14 Fixed in 2.11.14 Patch available GHSA-h3fg-h5v3-vf8m
solidus_frontend (RubyGems) Vendor— Affected 3.0.0 to before 3.0.5 Fixed in 3.0.5 Patch available GHSA-h3fg-h5v3-vf8m
solidus_frontend (RubyGems) Vendor— Affected 3.1.0 to before 3.1.5 Fixed in 3.1.5 Patch available GHSA-h3fg-h5v3-vf8m

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nebulab:solidus::::::::	before 2.11.14; 3.0.0 to before 3.0.5; 3.1.0 to before 3.1.5	Vulnerable	solidusio

cpe:2.3:a:nebulab:solidus:*:*:*:*:*:*:*:* Versions before 2.11.14; 3.0.0 to before 3.0.5; 3.1.0 to before 3.1.5 Vulnerable ·solidusio

Remediation

Fix · CNA solidus (solidusio) Fixed in 3.1.5, 3.0.5, 2.11.14
Fix · GHSA-h3fg-h5v3-vf8m solidus_frontend (RubyGems) Fixed in 2.11.14 Advisory →
Fix · GHSA-h3fg-h5v3-vf8m solidus_frontend (RubyGems) Fixed in 3.0.5 Advisory →
Fix · GHSA-h3fg-h5v3-vf8m solidus_frontend (RubyGems) Fixed in 3.1.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-43846
2026-10-03 Alias added: GHSA-h3fg-h5v3-vf8m

References

Exploit 1

https://github.com/solidusio/solidus/security/advisories/GHSA-h3fg-h5v3-vf8m

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-43846

Other 2

TI-2022-13046 CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend CVSS 3.1MEDIUM 4.3
TI-2021-19611 ReDos vulnerability on guest checkout email validation CVSS 3.1HIGH 7.5
TI-2020-11884 Ability to change order address without triggering address validations in solidus CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences