GMS-2021-4: Authentication Bypass by CSRF Weakness
(updated )
Impact
The actual vulnerability has been discovered on solidus_auth_devise. See GHSA-xm34-v85h-9pg2 for details.
The security advisory here exists to provide an extra layer of security in the form of a monkey patch for users who don’t update solidus_auth_devise. For this reason, it has been marked as low impact on this end.
Patches
For extra security, update solidus_core to versions 3.1.3, 3.0.3 or 2.11.12.
Workarounds
Look at the workarounds described at GHSA-xm34-v85h-9pg2.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in solidus_auth_devise or a discussion in solidus
- Email us at security@solidus.io
- Contact the core team on Slack
References
Code Behaviors & Features
Detect and mitigate GMS-2021-4 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →