GHSA-H3FG-H5V3-VF8M CSRF forgery protection bypass in solidus_frontend

Impact CSRF vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. All solidusfrontend versions are affected. If you're using your own storefront, please, follow along to make sure you're not affected. To reproduce the issue: - Pick the id for a...

CSRF forgery protection bypass in solidus_frontend

Impact CSRF vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. All solidusfrontend versions are affected. If you're using your own storefront, please, follow along to make sure you're not affected. To reproduce the issue: - Pick the id for a...

CSRF forgery protection bypass in solidus_frontend

Impact CSRF vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. All solidusfrontend versions are affected. If you're using your own storefront, please, follow along to make sure you're not affected. To reproduce the issue: - Pick the id for a...

CVE-2021-43846

solidusfrontend is the cart and storefront for the Solidus e-commerce project. Versions of solidusfrontend prior to 3.1.5, 3.0.5, and 2.11.14 contain a cross-site request forgery CSRF vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. Versions...

CVE-2021-43846 CSRF forgery protection bypass for Spree::OrdersController#populate

solidusfrontend is the cart and storefront for the Solidus e-commerce project. Versions of solidusfrontend prior to 3.1.5, 3.0.5, and 2.11.14 contain a cross-site request forgery CSRF vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. Versions...

CVE-2021-43846

CVE-2021-43846 (solidus_frontend CSRF) affects all solidus_frontend versions before 3.1.5, 3.0.5, and 2.11.14, enabling a malicious site to add items to a user’s cart via CSRF. A patch was introduced in those versions that adds CSRF token verification to the Add to cart action. Connected advisori...