Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:gem/solidus_frontend@2.10.2
purl pkg:gem/solidus_frontend@2.10.2
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 3.1
Vulnerabilities affecting this package (3)
Vulnerability Summary Fixed by
VCID-gwmf-crvu-tbdd
Aliases:
CVE-2020-15109
GHSA-3mvg-rrrw-m7ph
Ability to change order address without triggering address validations in solidus There are no reported fixed by versions.
VCID-qss2-pgck-eybx
Aliases:
CVE-2021-43846
GHSA-h3fg-h5v3-vf8m
CSRF forgery protection bypass in solidus_frontend
2.11.14
Affected by 2 other vulnerabilities.
3.0.0.rc2
Affected by 1 other vulnerability.
3.0.5
Affected by 1 other vulnerability.
3.1.5
Affected by 2 other vulnerabilities.
VCID-s3ju-k74e-1fbh
Aliases:
CVE-2022-31000
GHSA-8639-qx56-r428
solidus_backend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery (CSRF) vulnerability. The vulnerability allows attackers to change the state of an order's adjustments if they hold its number, and the execution happens on a store administrator's computer. Users should upgrade to solidus_backend 3.1.6, 3.0.6, or 2.11.16 to receive a patch.
2.11.16
Affected by 0 other vulnerabilities.
3.1.6
Affected by 0 other vulnerabilities.
3.0.0.rc2
Affected by 1 other vulnerability.
3.0.5
Affected by 1 other vulnerability.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-gwmf-crvu-tbdd Ability to change order address without triggering address validations in solidus CVE-2020-15109
GHSA-3mvg-rrrw-m7ph

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-13T09:21:20.009423+00:00 Ruby Importer Affected by VCID-qss2-pgck-eybx https://github.com/rubysec/ruby-advisory-db/blob/master/gems/solidus_frontend/CVE-2021-43846.yml 38.6.0
2026-06-13T09:20:49.998488+00:00 Ruby Importer Fixing VCID-gwmf-crvu-tbdd https://github.com/rubysec/ruby-advisory-db/blob/master/gems/solidus_frontend/CVE-2020-15109.yml 38.6.0
2026-06-13T09:20:49.444226+00:00 Ruby Importer Affected by VCID-gwmf-crvu-tbdd https://github.com/rubysec/ruby-advisory-db/blob/master/gems/solidus_frontend/CVE-2020-15109.yml 38.6.0
2026-06-12T18:25:00.371274+00:00 GitLab Importer Affected by VCID-s3ju-k74e-1fbh https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/solidus_frontend/CVE-2022-31000.yml 38.6.0
2026-06-12T17:54:35.610133+00:00 GitLab Importer Affected by VCID-qss2-pgck-eybx https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/solidus_frontend/CVE-2021-43846.yml 38.6.0
2026-06-12T17:23:40.356723+00:00 GitLab Importer Fixing VCID-gwmf-crvu-tbdd https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/solidus_frontend/CVE-2020-15109.yml 38.6.0
2026-06-12T08:01:51.946942+00:00 GithubOSV Importer Fixing VCID-gwmf-crvu-tbdd https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-3mvg-rrrw-m7ph/GHSA-3mvg-rrrw-m7ph.json 38.6.0
2026-06-11T20:26:23.740598+00:00 GHSA Importer Fixing VCID-gwmf-crvu-tbdd https://github.com/advisories/GHSA-3mvg-rrrw-m7ph 38.6.0