Vulnerabilities > CVE-2021-43846 - Unspecified vulnerability in Nebulab Solidus

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

LOW

Availability impact

NONE

network

low complexity

nebulab

NVD

Published: 2021-12-20

Updated: 2024-11-21

Summary

`solidus_frontend` is the cart and storefront for the Solidus e-commerce project. Versions of `solidus_frontend` prior to 3.1.5, 3.0.5, and 2.11.14 contain a cross-site request forgery (CSRF) vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. Versions 3.1.5, 3.0.5, and 2.11.14 contain a patch for this issue. The patch adds CSRF token verification to the "Add to cart" action. Adding forgery protection to a form that missed it can have some side effects. Other CSRF protection strategies as well as a workaround involving modifcation to config/application.rb` are available. More details on these mitigations are available in the GitHub Security Advisory.

Vulnerable Configurations

Part	Description	Count
Application	Nebulab Nebulab Solidus 1.0.0 Nebulab Solidus 1.0.1 Nebulab Solidus 1.0.2 Nebulab Solidus 1.0.3 Nebulab Solidus 1.0.4 Nebulab Solidus 1.0.5 Nebulab Solidus 1.0.6 Nebulab Solidus 1.0.7 Nebulab Solidus 1.1.0 Nebulab Solidus 1.1.1 Nebulab Solidus 1.1.2 Nebulab Solidus 1.1.3 Nebulab Solidus 1.1.4 Nebulab Solidus 1.2.0 Nebulab Solidus 1.2.1 Nebulab Solidus 1.2.2 Nebulab Solidus 1.2.3 Nebulab Solidus 1.3.0 Nebulab Solidus 1.3.1 Nebulab Solidus 1.3.2 Nebulab Solidus 1.4.0 Nebulab Solidus 1.4.1 Nebulab Solidus 1.4.2 Nebulab Solidus 2.0.0 Nebulab Solidus 2.0.1 Nebulab Solidus 2.0.2 Nebulab Solidus 2.0.3 Nebulab Solidus 2.1.0 Nebulab Solidus 2.1.1 Nebulab Solidus 2.2.0 Nebulab Solidus 2.2.1 Nebulab Solidus 2.2.2 Nebulab Solidus 2.3.0 Nebulab Solidus 2.3.1 Nebulab Solidus 2.4.0 Nebulab Solidus 2.4.1 Nebulab Solidus 2.4.2 Nebulab Solidus 2.5.0 Nebulab Solidus 2.5.1 Nebulab Solidus 2.5.2 Nebulab Solidus 2.6.0 Nebulab Solidus 2.6.1 Nebulab Solidus 2.6.2 Nebulab Solidus 2.6.3 Nebulab Solidus 2.6.4 Nebulab Solidus 2.6.5 Nebulab Solidus 2.6.6 Nebulab Solidus 2.7.0 Nebulab Solidus 2.7.1 Nebulab Solidus 2.7.2 Nebulab Solidus 2.7.3 Nebulab Solidus 2.7.4 Nebulab Solidus 2.8.0 Nebulab Solidus 2.8.1 Nebulab Solidus 2.8.2 Nebulab Solidus 2.8.3 Nebulab Solidus 2.8.4 Nebulab Solidus 2.8.5 Nebulab Solidus 2.8.6 Nebulab Solidus 2.9.0 Nebulab Solidus 2.9.1 Nebulab Solidus 2.9.2 Nebulab Solidus 2.9.3 Nebulab Solidus 2.9.4 Nebulab Solidus 2.9.5 Nebulab Solidus 2.9.6 Nebulab Solidus 2.10.0 Nebulab Solidus 2.10.1 Nebulab Solidus 2.10.2 Nebulab Solidus 2.10.3 Nebulab Solidus 2.10.4 Nebulab Solidus 2.10.5 Nebulab Solidus 2.11.0 Nebulab Solidus 2.11.1 Nebulab Solidus 2.11.2 Nebulab Solidus 2.11.3 Nebulab Solidus 2.11.4 Nebulab Solidus 2.11.5 Nebulab Solidus 2.11.6 Nebulab Solidus 2.11.7 Nebulab Solidus 2.11.8 Nebulab Solidus 2.11.9 Nebulab Solidus 2.11.10 Nebulab Solidus 2.11.11 Nebulab Solidus 2.11.12 Nebulab Solidus 2.11.13 Nebulab Solidus 3.0.0 Nebulab Solidus 3.0.1 Nebulab Solidus 3.0.2 Nebulab Solidus 3.0.3 Nebulab Solidus 3.0.4 Nebulab Solidus 3.1.0 Nebulab Solidus 3.1.1 Nebulab Solidus 3.1.2 Nebulab Solidus 3.1.3 Nebulab Solidus 3.1.4	130

Summary

Vulnerable Configurations

References