cve.bz

CVE-2022-31000

4.3 mediumEPSS 0.4%

Medium (4.3) in nebulab solidus. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in solidus_backend 2.11.16, 3.0.6, 3.1.6.

solidus_backend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery (CSRF) vulnerability. The vulnerability allows attackers to change the state of an order's adjustments if they hold its number, and the execution happens on a store administrator's computer. Users should upgrade to solidus_backend 3.1.6, 3.0.6, or 2.11.16 to receive a patch.

Severity

CVSS 3.1

4.3 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWE
CWE-352
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-8639-qx56-r428RubyGemssolidus_backend<2.11.162.11.16
GHSA-8639-qx56-r428RubyGemssolidus_backend>=3.0.0 <3.0.63.0.6
GHSA-8639-qx56-r428RubyGemssolidus_backend>=3.1.0 <3.1.63.1.6

References

Check your stackJSON