-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| solidus_backend | rubygems | < 2.11.16 | 2.11.16 |
| solidus_backend | rubygems | >= 3.0.0, < 3.0.6 | 3.0.6 |
| solidus_backend | rubygems | >= 3.1.0, < 3.1.6 | 3.1.6 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from state-changing operations (finalize/unfinalize) being exposed via GET requests in routes.rb. The commit diff shows these routes were originally configured with 'get' verbs, making them vulnerable to CSRF as Rails skips anti-forgery protection for GET requests. The controller actions mapped to these routes (unfinalize_adjustments and finalize_adjustments) would execute state changes without proper CSRF validation when accessed via GET, which was fixed by changing the HTTP method to PUT in both routes and view templates.
Ongoing coverage of React2Shell