Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-qss2-pgck-eybx
Vulnerability ID VCID-qss2-pgck-eybx
Aliases CVE-2021-43846
GHSA-h3fg-h5v3-vf8m
Summary CSRF forgery protection bypass in solidus_frontend
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-352 Cross-Site Request Forgery (CSRF)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00127 https://api.first.org/data/v1/epss?cve=CVE-2021-43846
epss 0.00127 https://api.first.org/data/v1/epss?cve=CVE-2021-43846
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-h3fg-h5v3-vf8m
cvssv3.1 5.3 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/solidus_frontend/CVE-2021-43846.yml
generic_textual MODERATE https://github.com/rubysec/ruby-advisory-db/blob/master/gems/solidus_frontend/CVE-2021-43846.yml
cvssv3.1 5.3 https://github.com/solidusio/solidus
generic_textual MODERATE https://github.com/solidusio/solidus
cvssv3.1 5.3 https://github.com/solidusio/solidus/commit/4d17cacf066d9492fc04eb3a0b16084b47376d81
generic_textual MODERATE https://github.com/solidusio/solidus/commit/4d17cacf066d9492fc04eb3a0b16084b47376d81
cvssv3.1 5.3 https://github.com/solidusio/solidus/commit/a1b9bf7f24f9b8684fc4d943eacb02b1926c77c6
generic_textual MODERATE https://github.com/solidusio/solidus/commit/a1b9bf7f24f9b8684fc4d943eacb02b1926c77c6
cvssv3 5.3 https://github.com/solidusio/solidus/security/advisories/GHSA-h3fg-h5v3-vf8m
cvssv3.1 5.3 https://github.com/solidusio/solidus/security/advisories/GHSA-h3fg-h5v3-vf8m
cvssv3.1_qr MODERATE https://github.com/solidusio/solidus/security/advisories/GHSA-h3fg-h5v3-vf8m
generic_textual MODERATE https://github.com/solidusio/solidus/security/advisories/GHSA-h3fg-h5v3-vf8m
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2021-43846
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2021-43846
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-43846
https://github.com/solidusio/solidus
https://github.com/solidusio/solidus/commit/4d17cacf066d9492fc04eb3a0b16084b47376d81
https://github.com/solidusio/solidus/commit/a1b9bf7f24f9b8684fc4d943eacb02b1926c77c6
CVE-2021-43846 https://nvd.nist.gov/vuln/detail/CVE-2021-43846
CVE-2021-43846.YML https://github.com/rubysec/ruby-advisory-db/blob/master/gems/solidus_frontend/CVE-2021-43846.yml
GHSA-h3fg-h5v3-vf8m https://github.com/advisories/GHSA-h3fg-h5v3-vf8m
GHSA-h3fg-h5v3-vf8m https://github.com/solidusio/solidus/security/advisories/GHSA-h3fg-h5v3-vf8m
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/solidus_frontend/CVE-2021-43846.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/solidusio/solidus
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/solidusio/solidus/commit/4d17cacf066d9492fc04eb3a0b16084b47376d81
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/solidusio/solidus/commit/a1b9bf7f24f9b8684fc4d943eacb02b1926c77c6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/solidusio/solidus/security/advisories/GHSA-h3fg-h5v3-vf8m
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-43846
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.31644
EPSS Score 0.00127
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T20:27:24.778108+00:00 GHSA Importer Import https://github.com/advisories/GHSA-h3fg-h5v3-vf8m 38.6.0