TI-2022-13046 Aliases CVE-2022-31000 GHSA-8639-qx56-r428

CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend

MEDIUM 53CWE-352Published 2022-06-01 · Updated 2025-04-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

solidus_backend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery (CSRF) vulnerability. The vulnerability allows attackers to change the state of an order's adjustments if they hold its number, and the execution happens on a store administrator's computer. Users should upgrade to solidus_backend 3.1.6, 3.0.6, or 2.11.16 to receive a patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00413 35th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed solidus (solidusio): 2.11.16, 3.0.6, 3.1.6solidus_backend (RubyGems): 2.11.16, 3.0.6, 3.1.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
solidusio	solidus	before 2.11.16; 3.0.0 to before 3.0.6; 3.1.0 to before 3.1.6	2.11.16, 3.0.6, 3.1.6	Patch available	CNA
—	solidus_backend (RubyGems)	before 2.11.16	2.11.16	Patch available	GHSA-8639-qx56-r428
—	solidus_backend (RubyGems)	3.0.0 to before 3.0.6	3.0.6	Patch available	GHSA-8639-qx56-r428
—	solidus_backend (RubyGems)	3.1.0 to before 3.1.6	3.1.6	Patch available	GHSA-8639-qx56-r428

solidus Vendorsolidusio Affected before 2.11.16; 3.0.0 to before 3.0.6; 3.1.0 to before 3.1.6 Fixed in 2.11.16, 3.0.6, 3.1.6 Patch available CNA
solidus_backend (RubyGems) Vendor— Affected before 2.11.16 Fixed in 2.11.16 Patch available GHSA-8639-qx56-r428
solidus_backend (RubyGems) Vendor— Affected 3.0.0 to before 3.0.6 Fixed in 3.0.6 Patch available GHSA-8639-qx56-r428
solidus_backend (RubyGems) Vendor— Affected 3.1.0 to before 3.1.6 Fixed in 3.1.6 Patch available GHSA-8639-qx56-r428

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nebulab:solidus::::::::	before 2.11.16; 3.0.0 to before 3.0.5; 3.1.0 to before 3.1.6	Vulnerable	solidusio

cpe:2.3:a:nebulab:solidus:*:*:*:*:*:*:*:* Versions before 2.11.16; 3.0.0 to before 3.0.5; 3.1.0 to before 3.1.6 Vulnerable ·solidusio

Remediation

Fix · CNA solidus (solidusio) Fixed in 2.11.16, 3.0.6, 3.1.6
Fix · GHSA-8639-qx56-r428 solidus_backend (RubyGems) Fixed in 2.11.16 Advisory →
Fix · GHSA-8639-qx56-r428 solidus_backend (RubyGems) Fixed in 3.0.6 Advisory →
Fix · GHSA-8639-qx56-r428 solidus_backend (RubyGems) Fixed in 3.1.6 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-31000
2026-10-03 Alias added: GHSA-8639-qx56-r428

References

Other 2

TI-2021-19611 ReDos vulnerability on guest checkout email validation CVSS 3.1HIGH 7.5
TI-2020-11884 Ability to change order address without triggering address validations in solidus CVSS 3.1MEDIUM 5.3
TI-2021-19652 CSRF forgery protection bypass for Spree::OrdersController#populate CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences