Skip to content
Fencer Intel
critical 9.3

GHSA-5629-8855-gf4g json

Authentication Bypass by CSRF Weakness

published 4y ago modified last yr.

cvss
9.3
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact The actual vulnerability has been discovered on `solidus_auth_devise`. See [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2) for details.

The security advisory here exists to provide an extra layer of security in the form of a monkey patch for users who don't update `solidus_auth_devise`. For this reason, it has been marked as low impact on this end.

### Patches For extra security, update `solidus_core` to versions `3.1.3`, `3.0.3` or `2.11.12`.

### Workarounds Look at the workarounds described at [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2).

### References - [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2).

### For more information If you have any questions or comments about this advisory: * Open an issue in [solidus_auth_devise](https://github.com/solidusio/solidus_auth_devise/issues) or a discussion in [solidus](https://github.com/solidusio/solidus/discussions) * Email us at [security@solidus.io](mailto:security@soliidus.io) * Contact the core team on [Slack](http://slack.solidus.io/)

Patch / fix

  • rubygems solidus_core 2.11.12, 3.0.3, 3.1.3

Is GHSA-5629-8855-gf4g in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by version score vector
GitHub 3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
rubygems solidus_core
<2.11.12
>=3.0.0, <3.0.3
>=3.1.0, <3.1.3
2.11.12
3.0.3
3.1.3

Classification

Weakness
  • CWE-305 Authentication Bypass by Primary Weakness
  • CWE-352 Cross-Site Request Forgery

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.