title: CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend
description: solidus_backend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery (CSRF) vulnerability. The vulnerability allows attackers to change the state of an order's adjustments if they hold its number, and the execution happens on a store administrator's computer. Users should upgrade to solidus_backend 3.1.6, 3.0.6, or 2.11.16 to receive a patch.
problem types: CWE-352: Cross-Site Request Forgery (CSRF)
affected:
{
product: solidus
vendor: solidusio
versions:
status: affected, version: < 2.11.16
status: affected, version: >= 3.0.0, < 3.0.6
status: affected, version: >= 3.1.0, < 3.1.6
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
version: 3.1
]