CVE-2021-43846

Katalog CVE

CVSS 4.3 · Medium EPSS 0,59%

Kerentanan Cross-Site Request Forgery (CSRF) pada nebulab solidus. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

`solidus_frontend` is the cart and storefront for the Solidus e-commerce project. Versions of `solidus_frontend` prior to 3.1.5, 3.0.5, and 2.11.14 contain a cross-site request forgery (CSRF) vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. Versions 3.1.5, 3.0.5, and 2.11.14 contain a patch for this issue. The patch adds CSRF token verification to the "Add to cart" action. Adding forgery protection to a form that missed it can have some side effects. Other CSRF protection strategies as well as a workaround involving modifcation to config/application.rb` are available. More details on these mitigations are available in the GitHub Security Advisory.

Rincian

Terbit di NVD

20 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/solidusio/solidus/commit/4d17cacf066d9492fc04eb3a0b16084b47376d81 patch · advisory pihak ketiga
• https://github.com/solidusio/solidus/commit/a1b9bf7f24f9b8684fc4d943eacb02b1926c77c6 patch · advisory pihak ketiga
• https://github.com/solidusio/solidus/security/advisories/GHSA-h3fg-h5v3-vf8m exploit · mitigasi · advisory pihak ketiga