{"answers":{"affected":"6 open source packages ship an affected version, including solidus_backend. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31000 exists.","fix":"Upgrade solidus_backend to a fixed version for your release line: 2.11.16, 3.0.6 or 3.1.6.","what":"CVE-2022-31000 is a low-severity vulnerability in solidusio solidus, published on 1 Jun 2022. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-31000 and fix it if it is affected.\n\nWhat it is: CVE-2022-31000 is a low-severity vulnerability in solidusio solidus, published on 1 Jun 2022. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31000 exists.\n\nAffected packages and fixed versions:\n- solidus_backend (RubyGems): affected all versions; fixed in 2.11.16\n- solidus_backend (RubyGems): affected all versions; fixed in 2.11.16\n- solidus_backend (RubyGems): affected from 3.0.0; fixed in 3.0.6\n- solidus_backend (RubyGems): affected from 3.0.0; fixed in 3.0.6\n- solidus_backend (RubyGems): affected from 3.1.0; fixed in 3.1.6\n- solidus_backend (RubyGems): affected from 3.1.0; fixed in 3.1.6\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-31000/ (Markdown: https://insights.sbomify.com/CVE-2022-31000/index.md)","id":"CVE-2022-31000","markdown":"https://insights.sbomify.com/CVE-2022-31000/index.md","name":"CVE-2022-31000","record":{"aliases":["GHSA-8639-qx56-r428"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_modify"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Solidus e-commerce framework","requires_auth":"high_privilege","summary":"Attackers can trick administrators into modifying order adjustments via CSRF, requiring an upgrade to the Solidus backend.","user_interaction":"not_required","vuln_class":"csrf"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"solidus","vendor":"nebulab"}],"cvss":{"score":2.3,"severity":"low","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-352","name":"Cross-Site Request Forgery"}],"description":"solidus_backend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery (CSRF) vulnerability. The vulnerability allows attackers to change the state of an order's adjustments if they hold its number, and the execution happens on a store administrator's computer. Users should upgrade to solidus_backend 3.1.6, 3.0.6, or 2.11.16 to receive a patch.","ecosystems":["RubyGems"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend","id":"CVE-2022-31000","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"RubyGems","product":null,"products":[],"type":"csrf","year":"2022"},"n_packages":6,"n_references":2,"next":{"headline":"Out-of-bounds Read in Sofia-SIP","id":"CVE-2022-31001"},"packages":[{"ecosystem":"RubyGems","fixed":["2.11.16"],"introduced":["0"],"last_affected":[],"package":"solidus_backend","purl":null,"source":"GHSA-8639-qx56-r428"},{"ecosystem":"RubyGems","fixed":["2.11.16"],"introduced":["0"],"last_affected":[],"package":"solidus_backend","purl":"pkg:gem/solidus_backend","source":"GHSA-8639-qx56-r428"},{"ecosystem":"RubyGems","fixed":["3.0.6"],"introduced":["3.0.0"],"last_affected":[],"package":"solidus_backend","purl":null,"source":"GHSA-8639-qx56-r428"},{"ecosystem":"RubyGems","fixed":["3.0.6"],"introduced":["3.0.0"],"last_affected":[],"package":"solidus_backend","purl":"pkg:gem/solidus_backend","source":"GHSA-8639-qx56-r428"},{"ecosystem":"RubyGems","fixed":["3.1.6"],"introduced":["3.1.0"],"last_affected":[],"package":"solidus_backend","purl":null,"source":"GHSA-8639-qx56-r428"},{"ecosystem":"RubyGems","fixed":["3.1.6"],"introduced":["3.1.0"],"last_affected":[],"package":"solidus_backend","purl":"pkg:gem/solidus_backend","source":"GHSA-8639-qx56-r428"}],"prev":{"headline":"Possible cross-site scripting attack via unsanitized SVG files in FoF Upload","id":"CVE-2022-30999"},"products":["solidus"],"published":"2022-06-01","related":[{"cvss_score":7.5,"headline":"ReDos vulnerability on guest checkout email validation","id":"CVE-2021-43805","kev_date_added":null,"published":"2021-12-07"},{"cvss_score":5.3,"headline":"CSRF forgery protection bypass for Spree::OrdersController#populate","id":"CVE-2021-43846","kev_date_added":null,"published":"2021-12-20"},{"cvss_score":5.3,"headline":"Ability to change order address without triggering address validations in solidus","id":"CVE-2020-15109","kev_date_added":null,"published":"2020-08-04"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-04-22","vendors":["solidusio"]},"summary":"Attackers can trick administrators into modifying order adjustments via CSRF, requiring an upgrade to the Solidus backend.","url":"https://insights.sbomify.com/CVE-2022-31000/"}