GitHub Advisoryadvisory · RubyGems

GHSA-5629-8855-gf4g Authentication Bypass by CSRF Weakness

CRITICAL Published 2021-11-18 Modified 2021-11-17 Official page ↗
Ecosystem
RubyGems
Packages
solidus_core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-305, CWE-352
Reviewed
2021-11-17

Affected packages

• RubyGems solidus_core: < 2.11.12 → fixed in 2.11.12 • RubyGems solidus_core: >= 3.0.0, < 3.0.3 → fixed in 3.0.3 • RubyGems solidus_core: >= 3.1.0, < 3.1.3 → fixed in 3.1.3

Description

Impact The actual vulnerability has been discovered on `solidus_auth_devise`. See GHSA-xm34-v85h-9pg2 for details. The security advisory here exists to provide an extra layer of security in the form of a monkey patch for users who don't update `solidus_auth_devise`. For this reason, it has been marked as low impact on this end. Patches For extra security, update `solidus_core` to versions `3.1.3`, `3.0.3` or `2.11.12`. Workarounds Look at the workarounds described at GHSA-xm34-v85h-9pg2. References • GHSA-xm34-v85h-9pg2. For more information If you have any questions or comments about this advisory: • Open an issue in solidus_auth_devise or a discussion in solidus • Email us at [email protected] • Contact the core team on Slack

Related

Weakness · CWE (2)

  • CWE-305 Authentication Bypass by Primary Weakness weakness
  • CWE-352 Cross-Site Request Forgery weakness

References