PT-2022-20447 · Unknown · Solidus Backend

Published 2022-06-01 · Updated 2022-06-08 · CVE-2022-31000

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions solidus backend versions prior to 3.1.6 solidus backend versions prior to 3.0.6 solidus backend versions prior to 2.11.16

Description The vulnerability is a cross-site request forgery (CSRF) issue that allows attackers to change the state of an order's adjustments if they hold its number. This execution occurs on a store administrator's computer.

Recommendations For solidus backend versions prior to 3.1.6, upgrade to version 3.1.6 to receive the patch. For solidus backend versions prior to 3.0.6, upgrade to version 3.0.6 to receive the patch. For solidus backend versions prior to 2.11.16, upgrade to version 2.11.16 to receive the patch. As a temporary workaround, consider restricting access to the /admin/orders/{order number}/adjustments/unfinalize and /admin/orders/{order number}/adjustments/finalize API endpoints until a patch is available.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-31000

GHSA-8639-QX56-R428

Affected Products

Solidus Backend

References · 11

• 🔥 https://github.com/solidusio/solidus/security/advisories/GHSA-8639-qx56-r428 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31000.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/solidus_backend/CVE-2022-31000.yml · Exploit
• https://github.com/solidusio/solidus/commit/de796a2e0be7f154cae48b46e267501559d9716c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31000 · Security Note
• https://osv.dev/vulnerability/GHSA-8639-qx56-r428 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31000 · Vendor Advisory
• https://github.com/solidusio/solidus · Note
• https://t.me/cvenotify/31325 · Telegram Post
• https://t.me/cvenotify/30983 · Telegram Post
• https://t.me/cibsecurity/43612 · Telegram Post