Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF by allowing attackers to change the state of an order's adjustments if they hold its number, and the execution happens on a store administrator's computer. Remediation Upgrade solidusbackend to version...

CVE-2022-31000 CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend

solidusbackend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery CSRF vulnerability. The vulnerability allows attackers to change the state of an order's adjustments if they hold its number, and the...

PT-2022-20447

Name of the Vulnerable Software and Affected Versions solidus backend versions prior to 3.1.6 solidus backend versions prior to 3.0.6 solidus backend versions prior to 2.11.16 Description The vulnerability is a cross-site request forgery CSRF issue that allows attackers to change the state of an...