CVE-2020-15109

In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section.

• CWE-20
• CWE-862

• https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889dPatch, Third Party Advisory
• https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7phExploit, Third Party Advisory
• https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889dPatch, Third Party Advisory
• https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7phExploit, Third Party Advisory

Published

Aug 4, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15103In FreeRDP less than or equal to 2.1.2, an integer overflow …3.5
• CVE-2020-15104In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 …5.4
• CVE-2020-15105Django Two-Factor Authentication before 1.12, stores the use…5.4
• CVE-2020-15106In etcd before versions 3.3.23 and 3.4.10, a large slice cau…6.5
• CVE-2020-15107In openenclave before 0.10.0, enclaves that use x87 FPU oper…5.3
• CVE-2020-15108In glpi before 9.5.1, there is a SQL injection for all usage…7.1
• CVE-2020-1511An elevation of privilege vulnerability exists when Connecte…7.8
• CVE-2020-15110In jupyterhub-kubespawner before 0.12, certain usernames wil…8.1
• CVE-2020-15111In Fiber before version 1.12.6, the filename that is given i…5.4
• CVE-2020-15112In etcd before versions 3.3.23 and 3.4.10, it is possible to…6.5
• CVE-2020-15113In etcd before versions 3.3.23 and 3.4.10, certain directory…7.1
• CVE-2020-15114In etcd before versions 3.3.23 and 3.4.10, the etcd gateway …7.7