{"containers": {"cna": {"affected": [{"product": "solidus", "vendor": "solidusio", "versions": [{"status": "affected", "version": "< 2.8.6"}, {"status": "affected", "version": ">= 2.9.0, < 2.9.6"}, {"status": "affected", "version": ">= 2.10.0, < 2.10.2"}]}], "descriptions": [{"lang": "en", "value": "In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20: Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-08-04T23:00:16", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph"}, {"tags": ["x_refsource_MISC"], "url": "https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d"}], "source": {"advisory": "GHSA-3mvg-rrrw-m7ph", "discovery": "UNKNOWN"}, "title": "Ability to change order address without triggering address validations in solidus", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2020-15109", "STATE": "PUBLIC", "TITLE": "Ability to change order address without triggering address validations in solidus"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "solidus", "version": {"version_data": [{"version_value": "< 2.8.6"}, {"version_value": ">= 2.9.0, < 2.9.6"}, {"version_value": ">= 2.10.0, < 2.10.2"}]}}]}, "vendor_name": "solidusio"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-20: Improper Input Validation"}]}]}, "references": {"reference_data": [{"name": "https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph", "refsource": "CONFIRM", "url": "https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph"}, {"name": "https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d", "refsource": "MISC", "url": "https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d"}]}, "source": {"advisory": "GHSA-3mvg-rrrw-m7ph", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T13:08:21.891Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2020-15109", "datePublished": "2020-08-04T23:00:16", "dateReserved": "2020-06-25T00:00:00", "dateUpdated": "2024-08-04T13:08:21.891Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nebulab:solidus:*:*:*:*:*:*:*:*", "matchCriteriaId": "3AE5C6C1-50C2-4D8A-A1A1-1679BF2BD616", "versionEndExcluding": "2.8.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:nebulab:solidus:*:*:*:*:*:*:*:*", "matchCriteriaId": "83119E07-1C20-4CD2-8561-2B6AF76A460C", "versionEndExcluding": "2.9.6", "versionStartIncluding": "2.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nebulab:solidus:*:*:*:*:*:*:*:*", "matchCriteriaId": "57EEBC07-382C-4A07-965F-CD2FB7110CC9", "versionEndExcluding": "2.10.2", "versionStartIncluding": "2.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section."}, {"lang": "es", "value": "En solidus versiones anteriores a 2.8.6, 2.9.6 y 2.10.2, se presenta la posibilidad de cambiar la direcci\u00f3n del pedido sin activar comprobaciones de direcci\u00f3n. Esta vulnerabilidad permite a un cliente malicioso crear datos de petici\u00f3n con par\u00e1metros que permitan cambiar la direcci\u00f3n del pedido actual sin cambiar los costos de env\u00edo asociados con el nuevo env\u00edo. Todas las tiendas con al menos dos zonas de env\u00edo y diferentes costos de env\u00edo por zona est\u00e1n afectadas. Este problema proviene de c\u00f3mo se estructuran los atributos permitidos de pago. Tenemos una lista \u00fanica de atributos que est\u00e1n permitidos en todo el proceso de pago, sin importar el paso que esta siendo enviado. Consulte la referencia vinculada para m\u00e1s informaci\u00f3n. Como una soluci\u00f3n alternativa, si no es posible actualizar a una versi\u00f3n parcheada compatible, use esta esencia en la secci\u00f3n de referencias"}], "id": "CVE-2020-15109", "lastModified": "2021-11-18T18:29:16.957", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2020-08-04T23:15:10.347", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}