CVE-2020-15109 (GCVE-0-2020-15109)

Vulnerability from cvelistv5 – Published: 2020-08-04 23:00 – Updated: 2024-08-04 13:08
VLAI?
Summary
In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section.
Severity ?
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
  • CWE-20 - Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version
solidusio solidus Affected: < 2.8.6
Affected: >= 2.9.0, < 2.9.6
Affected: >= 2.10.0, < 2.10.2
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:08:21.891Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "solidus",
          "vendor": "solidusio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.9.0, \u003c 2.9.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.10.0, \u003c 2.10.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-08-04T23:00:16",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d"
        }
      ],
      "source": {
        "advisory": "GHSA-3mvg-rrrw-m7ph",
        "discovery": "UNKNOWN"
      },
      "title": "Ability to change order address without triggering address validations in solidus",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15109",
          "STATE": "PUBLIC",
          "TITLE": "Ability to change order address without triggering address validations in solidus"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "solidus",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 2.8.6"
                          },
                          {
                            "version_value": "\u003e= 2.9.0, \u003c 2.9.6"
                          },
                          {
                            "version_value": "\u003e= 2.10.0, \u003c 2.10.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "solidusio"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20: Improper Input Validation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph",
              "refsource": "CONFIRM",
              "url": "https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph"
            },
            {
              "name": "https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d",
              "refsource": "MISC",
              "url": "https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-3mvg-rrrw-m7ph",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-15109",
    "datePublished": "2020-08-04T23:00:16",
    "dateReserved": "2020-06-25T00:00:00",
    "dateUpdated": "2024-08-04T13:08:21.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:nebulab:solidus:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.8.6\", \"matchCriteriaId\": \"3AE5C6C1-50C2-4D8A-A1A1-1679BF2BD616\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:nebulab:solidus:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.9.0\", \"versionEndExcluding\": \"2.9.6\", \"matchCriteriaId\": \"83119E07-1C20-4CD2-8561-2B6AF76A460C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:nebulab:solidus:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.10.0\", \"versionEndExcluding\": \"2.10.2\", \"matchCriteriaId\": \"57EEBC07-382C-4A07-965F-CD2FB7110CC9\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section.\"}, {\"lang\": \"es\", \"value\": \"En solidus versiones anteriores a 2.8.6, 2.9.6 y 2.10.2, se presenta la posibilidad de cambiar la direcci\\u00f3n del pedido sin activar comprobaciones de direcci\\u00f3n. Esta vulnerabilidad permite a un cliente malicioso crear datos de petici\\u00f3n con par\\u00e1metros que permitan cambiar la direcci\\u00f3n del pedido actual sin cambiar los costos de env\\u00edo asociados con el nuevo env\\u00edo. Todas las tiendas con al menos dos zonas de env\\u00edo y diferentes costos de env\\u00edo por zona est\\u00e1n afectadas. Este problema proviene de c\\u00f3mo se estructuran los atributos permitidos de pago. Tenemos una lista \\u00fanica de atributos que est\\u00e1n permitidos en todo el proceso de pago, sin importar el paso que esta siendo enviado. Consulte la referencia vinculada para m\\u00e1s informaci\\u00f3n. Como una soluci\\u00f3n alternativa, si no es posible actualizar a una versi\\u00f3n parcheada compatible, use esta esencia en la secci\\u00f3n de referencias\"}]",
      "id": "CVE-2020-15109",
      "lastModified": "2024-11-21T05:04:49.830",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:N/I:P/A:N\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2020-08-04T23:15:10.347",
      "references": "[{\"url\": \"https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-862\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2020-15109\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2020-08-04T23:15:10.347\",\"lastModified\":\"2024-11-21T05:04:49.830\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section.\"},{\"lang\":\"es\",\"value\":\"En solidus versiones anteriores a 2.8.6, 2.9.6 y 2.10.2, se presenta la posibilidad de cambiar la direcci\u00f3n del pedido sin activar comprobaciones de direcci\u00f3n. Esta vulnerabilidad permite a un cliente malicioso crear datos de petici\u00f3n con par\u00e1metros que permitan cambiar la direcci\u00f3n del pedido actual sin cambiar los costos de env\u00edo asociados con el nuevo env\u00edo. Todas las tiendas con al menos dos zonas de env\u00edo y diferentes costos de env\u00edo por zona est\u00e1n afectadas. Este problema proviene de c\u00f3mo se estructuran los atributos permitidos de pago. Tenemos una lista \u00fanica de atributos que est\u00e1n permitidos en todo el proceso de pago, sin importar el paso que esta siendo enviado. Consulte la referencia vinculada para m\u00e1s informaci\u00f3n. Como una soluci\u00f3n alternativa, si no es posible actualizar a una versi\u00f3n parcheada compatible, use esta esencia en la secci\u00f3n de referencias\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:P/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nebulab:solidus:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.8.6\",\"matchCriteriaId\":\"3AE5C6C1-50C2-4D8A-A1A1-1679BF2BD616\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nebulab:solidus:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.9.0\",\"versionEndExcluding\":\"2.9.6\",\"matchCriteriaId\":\"83119E07-1C20-4CD2-8561-2B6AF76A460C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nebulab:solidus:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.10.0\",\"versionEndExcluding\":\"2.10.2\",\"matchCriteriaId\":\"57EEBC07-382C-4A07-965F-CD2FB7110CC9\"}]}]}],\"references\":[{\"url\":\"https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.