CVE-2022-31000: Cross-Site Request Forgery (CSRF)

June 1, 2022

solidus_backend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery (CSRF) vulnerability. The vulnerability allows attackers to change the state of an order’s adjustments if they hold its number, and the execution happens on a store administrator’s computer. Users should upgrade to solidus_backend 3.1.6, 3.0.6, or 2.11.16 to receive a patch.

References

github.com/advisories/GHSA-8639-qx56-r428
github.com/solidusio/solidus/commit/de796a2e0be7f154cae48b46e267501559d9716c
github.com/solidusio/solidus/security/advisories/GHSA-8639-qx56-r428
nvd.nist.gov/vuln/detail/CVE-2022-31000

Code Behaviors & Features

Detect and mitigate CVE-2022-31000 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →