Vulnerabilities

TI-2022-13046 CVE-2022-31000 · GHSA-8639-qx56-r428

CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend

MEDIUM 53

solidus_backend is the admin interface for the Solidus e-commerce framework.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00413 Published 2022-06-01 Fixed in 2.11.16, 3.0.6 +1 CWE-352

TI-2021-19652 CVE-2021-43846 · GHSA-h3fg-h5v3-vf8m

LOW 25

`solidus_frontend` is the cart and storefront for the Solidus e-commerce project.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00594 Published 2021-12-20 Fixed in 3.1.5, 3.0.5 +1 CWE-352

TI-2021-19611 CVE-2021-43805 · GHSA-qxmr-qxh6-2cc9

LOW 36

Solidus is a free, open-source ecommerce platform built on Rails.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01449 Published 2021-12-07 Fixed in 3.1.4, 3.0.4 +1 CWE-1333

TI-2021-18106 CVE-2021-41274 · GHSA-xm34-v85h-9pg2

MEDIUM 41

solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00726 Published 2021-11-17 Fixed in 2.5.4 CWE-352

TI-2020-11884 CVE-2020-15109 · GHSA-3mvg-rrrw-m7ph

LOW 26

In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00999 Published 2020-08-04 Fixed in 2.8.6, 2.9.6 +1 CWE-20