CVE-2021-43846

`solidus_frontend` is the cart and storefront for the Solidus e-commerce project. Versions of `solidus_frontend` prior to 3.1.5, 3.0.5, and 2.11.14 contain a cross-site request forgery (CSRF) vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. Versions 3.1.5, 3.0.5, and 2.11.14 contain a patch for this issue. The patch adds CSRF token verification to the "Add to cart" action. Adding forgery protection to a form that missed it can have some side effects. Other CSRF protection strategies as well as a workaround involving modifcation to config/application.rb` are available. More details on these mitigations are available in the GitHub Security Advisory.

• CWE-352

• https://github.com/solidusio/solidus/commit/4d17cacf066d9492fc04eb3a0b16084b47376d81Patch, Third Party Advisory
• https://github.com/solidusio/solidus/commit/a1b9bf7f24f9b8684fc4d943eacb02b1926c77c6Patch, Third Party Advisory
• https://github.com/solidusio/solidus/security/advisories/GHSA-h3fg-h5v3-vf8mExploit, Mitigation, Third Party Advisory
• https://github.com/solidusio/solidus/commit/4d17cacf066d9492fc04eb3a0b16084b47376d81Patch, Third Party Advisory
• https://github.com/solidusio/solidus/commit/a1b9bf7f24f9b8684fc4d943eacb02b1926c77c6Patch, Third Party Advisory
• https://github.com/solidusio/solidus/security/advisories/GHSA-h3fg-h5v3-vf8mExploit, Mitigation, Third Party Advisory

Published

Dec 20, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43840message_bus is a messaging bus for Ruby processes and web cl…6.5
• CVE-2021-43841XWiki is a generic wiki platform offering runtime services f…5.4
• CVE-2021-43842Wiki.js is a wiki app built on Node.js. Wiki.js versions 2.5…5.4
• CVE-2021-43843jsx-slack is a package for building JSON objects for Slack b…7.5
• CVE-2021-43844MSEdgeRedirect is a tool to redirect news, search, widgets, …8.8
• CVE-2021-43845PJSIP is a free and open source multimedia communication lib…9.1
• CVE-2021-43847HumHub is an open-source social network kit written in PHP. …6.5
• CVE-2021-43848h2o is an open source http server. In code prior to the `8c0…5.9
• CVE-2021-43849cordova-plugin-fingerprint-aio is a plugin provides a single…5.5
• CVE-2021-4385The WP Private Content Plus plugin for WordPress is vulnerab…4.3
• CVE-2021-43850Discourse is an open source platform for community discussio…6.8
• CVE-2021-43851Anuko Time Tracker is an open source, web-based time trackin…8.8