Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend
Vulnerability Description
solidus_backend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery (CSRF) vulnerability. The vulnerability allows attackers to change the state of an order's adjustments if they hold its number, and the execution happens on a store administrator's computer. Users should upgrade to solidus_backend 3.1.6, 3.0.6, or 2.11.16 to receive a patch.
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Vulnerability Type
跨站请求伪造(CSRF)
Vulnerability Title
Solidus 跨站请求伪造漏洞
Vulnerability Description
Solidus是一套开源的电子商务系统。 Solidus solidus_backend 3.1.6、3.0.6 和 2.11.16 之前版本存在跨站请求伪造漏洞，攻击者利用该漏洞可在持有订单编号的情况下更改订单调整的状态，并且执行发生在商店管理员的计算机上。
CVSS Information
N/A
Vulnerability Type
N/A