CVE-2021-41274: Cross-Site Request Forgery (CSRF)

November 17, 2021 (updated November 24, 2021)

solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem.Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

References

github.com/solidusio/solidus_auth_devise/commit/731a6645e90ea9fd228f78ec53c6976c048a0555
github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
nvd.nist.gov/vuln/detail/CVE-2021-41274

Code Behaviors & Features

Detect and mitigate CVE-2021-41274 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →