Solidus Auth Devise
Approved changes feed: RSS · Atom
cpe:2.3:a:solidusio:solidus_auth_devise:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Solidusio (5e1f39c9-39b4-5851-b63b-d3a65b006d8b) |
|---|---|
| Product | Solidus Auth Devise (fcc36099-73b6-51bf-8deb-5c6e0410cc30) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-41274 |
vulnerable | 2026-06-08 05:35:20.091068 |
Authentication Bypass by CSRF Weakness
CRITICAL (9.3)
solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `solidus_auth_devise` are affected if `protect_from_forgery` method is both: Executed whether as: A `before_action` callback (the default) or A `prepend_before_action` (option `prepend: true` given) before the `:load_object` hook in `Spree::UserController` (most likely order to find). Configured to use `:null_session` or `:reset_session` strategies (`:null_session` is the default in case the no strategy is given, but `rails --new` generated skeleton use `:exception`). Users should promptly update to `solidus_auth_devise` version `2.5.4`. Users unable to update should if possible, change their strategy to `:exception`. Please see the linked GHSA for more workaround details.
Published: 2021-11-17T19:55:11.000Z
Updated: 2024-08-04T03:08:31.696Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.