Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact CSRF vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. All solidusfrontend versions are affected. If you're using your own storefront, please, follow along to make sure you're not affected. To reproduce the issue: - Pick the id for a variant with available stock. From the rails console: Say we pick variant id 2. - Launch your application, for instance, on http://localhost:3000: - Open your browser dev tools. - Click on whatever link in your store. - Copy the value of the Cookie request header sent for the previous request from your browser dev tools. - Execute the following, using your previously selected variant id and the value of the Cookie header (notice how it doesn't contain any authentication token): - Reload your browser and look at how your cart got updated. Patches Please, upgrade solidus to versions 3.1.5, 3.0.5 or 2.11.14. After upgrading, make sure you read the "Upgrade notes" section below. Upgrade notes The…
Recommended action: Upgrade to 3.1.5, 3.0.5 or 2.11.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. E.g. 1. Store admin configured the store so that there are two zones in US: - East Cost Zone - Shipping Method cost: $1 - West Cost Zone - Shipping Method cost: $10 The attacker user can know that shipping to NY is less expensive than to LA just by testing different addresses in checkout. 2. The attacker user enters any NY shipping address in the address step 3. The attacker user chooses the $1 delivery option 4. The attacker user crafts a request with their real LA address, similar to: 5. The attacker user proceeds with checking out with a new address and the $1 shipment costs. Another scenario where this could be dangerous is: You cannot ship products in some zones and you…
Recommended action: Upgrade to 2.10.2, 2.9.6 or 2.8.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.