Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

RubyGems package

solidus_auth_devise

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.3RubyGemsPublished

    Authentication Bypass by CSRF Weakness

    CVE-2021-41274 · GHSA-xm34-v85h-9pg2

    Affected
    • RubyGems solidus_auth_devise >= 1.0.0, < 2.5.4
    Fixed in
    2.5.4· Vendor fix available
    Issue
    Impact CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of solidusauthdevise are affected if protectfromforgery method is both: - Executed whether as: - A beforeaction callback (the default) - A prependbeforeaction (option prepend: true given) before the :loadobject hook in Spree::UserController (most likely order to find). - Configured to use :nullsession or :resetsession strategies (:nullsession is the default in case the no strategy is given, but rails --new generated skeleton use :exception). That means that applications that haven't been configured differently from what it's generated with Rails aren't affected. Patches Users should promptly update to solidusauthdevise version 2.5.4. Workarounds A couple of options: - If possible, change your strategy to :exception: - Add the following to config/application.rb to at least run the :exception strategy on the affected controller: - We've also released new Solidus…

    Recommended action: Upgrade to 2.5.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →