{"metadata": {"vulnerability": "GHSA-XM34-V85H-9PG2", "count": 16, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 11}}, "data": [{"timestamp": "2021-09-15T00:00:00Z", "date_only": false, "value": "2021-09-15T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5 \u00b7 CVE-2021-41274", "record": "CVE-2021-41274", "field": "cveMetadata.dateReserved", "linked_record": true}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": true, "value": "2021-11-17", "kind": "other", "label": "Pubdate", "source": "gsd \u00b7 GSD-2021-41274", "record": "GSD-2021-41274", "field": "namespaces.gitlab.com.advisories.0.pubdate", "linked_record": true}, {"timestamp": "2021-11-17T19:55:11Z", "date_only": false, "value": "2021-11-17T19:55:11.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5 \u00b7 CVE-2021-41274", "record": "CVE-2021-41274", "field": "cveMetadata.datePublished", "linked_record": true}, {"timestamp": "2021-11-17T19:55:11Z", "date_only": false, "value": "2021-11-17T19:55:11.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2021-41274 / GitHub_M", "record": "CVE-2021-41274", "field": "containers.cna.providerMetadata.dateUpdated", "linked_record": true}, {"timestamp": "2021-11-17T19:57:48Z", "date_only": false, "value": "2021-11-17T19:57:48Z", "kind": "other", "label": "Updated", "source": "github", "record": "GHSA-XM34-V85H-9PG2", "field": "modified"}, {"timestamp": "2021-11-17T20:15:00Z", "date_only": false, "value": "2021-11-17T20:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github", "record": "GHSA-XM34-V85H-9PG2", "field": "database_specific.nvd_published_at"}, {"timestamp": "2021-11-17T20:15:00Z", "date_only": false, "value": "2021-11-17T20:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2021-41274", "record": "GSD-2021-41274", "field": "namespaces.nvd.nist.gov.publishedDate", "linked_record": true}, {"timestamp": "2021-11-17T22:15:07Z", "date_only": false, "value": "2021-11-17T22:15:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cibsecurity/32557", "record": "GHSA-XM34-V85H-9PG2", "field": "creation_timestamp", "uuid": "533e7467-ed61-4eb3-a317-65a9de440098", "content": "\u203c CVE-2021-41275 \u203c\n\nspree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an underlying Devise authentication framework. In affected versions spree_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both: Executed whether as: A before_action callback (the default). A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find). Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception). Users are advised to update their spree_auth_devise gem. For users unable to update it may be possible to change your strategy to :exception. Please see the linked GHSA for more workaround details. ### Impact CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both: * Executed whether as: * A before_action callback (the default) * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find). * Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception). That means that applications that haven't been configured differently from what it's generated with Rails aren't affected. Thanks @waiting-for-dev for reporting and providing a patch ? ### Patches Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 ### Workarounds If possible, change your strategy to :exception: ```ruby class ApplicationController < ActionController::Base protect_from_forgery with: :exception end ``` Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller: ```ruby config.after_initialize do Spree::UsersController.protect_from_forgery with: :exception end ``` ### References https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/32557", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2021-11-18T00:00:00Z", "date_only": true, "value": "2021-11-18", "kind": "other", "label": "Date", "source": "gsd \u00b7 GSD-2021-41274", "record": "GSD-2021-41274", "field": "namespaces.github.com/rubysec/ruby-advisory-db.date", "linked_record": true}, {"timestamp": "2021-11-18T00:00:00Z", "date_only": false, "value": "2021-11-18T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "gsd \u00b7 GSD-2021-41274", "record": "GSD-2021-41274", "field": "gsd.osvSchema.published", "linked_record": true}, {"timestamp": "2021-11-18T00:00:00Z", "date_only": false, "value": "2021-11-18T00:00:00.000Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-41274", "record": "GSD-2021-41274", "field": "gsd.osvSchema.modified", "linked_record": true}, {"timestamp": "2021-11-18T20:09:32Z", "date_only": false, "value": "2021-11-18T20:09:32Z", "kind": "milestone", "label": "Published", "source": "github", "record": "GHSA-XM34-V85H-9PG2", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2021-11-24T00:00:00Z", "date_only": true, "value": "2021-11-24", "kind": "other", "label": "Date", "source": "gsd \u00b7 GSD-2021-41274", "record": "GSD-2021-41274", "field": "namespaces.gitlab.com.advisories.0.date", "linked_record": true}, {"timestamp": "2021-11-24T04:48:00Z", "date_only": false, "value": "2021-11-24T04:48Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2021-41274", "record": "GSD-2021-41274", "field": "namespaces.nvd.nist.gov.lastModifiedDate", "linked_record": true}, {"timestamp": "2024-08-04T03:08:31.696Z", "date_only": false, "value": "2024-08-04T03:08:31.696Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2021-41274", "record": "CVE-2021-41274", "field": "cveMetadata.dateUpdated", "linked_record": true}, {"timestamp": "2024-08-04T03:08:31.696Z", "date_only": false, "value": "2024-08-04T03:08:31.696Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2021-41274 / CVE", "record": "CVE-2021-41274", "field": "containers.adp.0.providerMetadata.dateUpdated", "linked_record": true}], "metrics": {"as_of": "2026-11-11T17:19:56.220Z", "anchors": {"origin": {"timestamp": "2021-11-18T20:09:32Z", "date_only": false, "value": "2021-11-18T20:09:32Z", "kind": "milestone", "label": "Published", "source": "github", "record": "GHSA-XM34-V85H-9PG2", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2021-11-18T20:09:32Z", "date_only": false, "value": "2021-11-18T20:09:32Z", "kind": "milestone", "label": "Published", "source": "github", "record": "GHSA-XM34-V85H-9PG2", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2021-11-17T22:15:07Z", "date_only": false, "value": "2021-11-17T22:15:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cibsecurity/32557", "record": "GHSA-XM34-V85H-9PG2", "field": "creation_timestamp", "uuid": "533e7467-ed61-4eb3-a317-65a9de440098", "content": "\u203c CVE-2021-41275 \u203c\n\nspree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an underlying Devise authentication framework. In affected versions spree_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both: Executed whether as: A before_action callback (the default). A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find). Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception). Users are advised to update their spree_auth_devise gem. For users unable to update it may be possible to change your strategy to :exception. Please see the linked GHSA for more workaround details. ### Impact CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both: * Executed whether as: * A before_action callback (the default) * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find). * Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception). That means that applications that haven't been configured differently from what it's generated with Rails aren't affected. Thanks @waiting-for-dev for reporting and providing a patch ? ### Patches Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 ### Workarounds If possible, change your strategy to :exception: ```ruby class ApplicationController < ActionController::Base protect_from_forgery with: :exception end ``` Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller: ```ruby config.after_initialize do Spree::UsersController.protect_from_forgery with: :exception end ``` ### References https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/32557", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": -78865.0, "hours": -21.906944444444445, "days": -0.9127893518518518, "min_seconds": -78865.0, "max_seconds": -78865.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2021-11-18T20:09:32Z", "date_only": false, "value": "2021-11-18T20:09:32Z", "kind": "milestone", "label": "Published", "source": "github", "record": "GHSA-XM34-V85H-9PG2", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2021-11-17T22:15:07Z", "date_only": false, "value": "2021-11-17T22:15:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cibsecurity/32557", "record": "GHSA-XM34-V85H-9PG2", "field": "creation_timestamp", "uuid": "533e7467-ed61-4eb3-a317-65a9de440098", "content": "\u203c CVE-2021-41275 \u203c\n\nspree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an underlying Devise authentication framework. In affected versions spree_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both: Executed whether as: A before_action callback (the default). A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find). Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception). Users are advised to update their spree_auth_devise gem. For users unable to update it may be possible to change your strategy to :exception. Please see the linked GHSA for more workaround details. ### Impact CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both: * Executed whether as: * A before_action callback (the default) * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find). * Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception). That means that applications that haven't been configured differently from what it's generated with Rails aren't affected. Thanks @waiting-for-dev for reporting and providing a patch ? ### Patches Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 ### Workarounds If possible, change your strategy to :exception: ```ruby class ApplicationController < ActionController::Base protect_from_forgery with: :exception end ``` Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller: ```ruby config.after_initialize do Spree::UsersController.protect_from_forgery with: :exception end ``` ### References https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/32557", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 157151424.220523, "hours": 43653.17339458972, "days": 1818.8822247745718, "min_seconds": 157151424.220523, "max_seconds": 157151424.220523, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-11-18T20:09:32Z", "date_only": false, "value": "2021-11-18T20:09:32Z", "kind": "milestone", "label": "Published", "source": "github", "record": "GHSA-XM34-V85H-9PG2", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T17:19:56.220Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 157230289.220523, "hours": 43675.08033903417, "days": 1819.7950141264237, "min_seconds": 157230289.220523, "max_seconds": 157230289.220523, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-11-17T22:15:07Z", "date_only": false, "value": "2021-11-17T22:15:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cibsecurity/32557", "record": "GHSA-XM34-V85H-9PG2", "field": "creation_timestamp", "uuid": "533e7467-ed61-4eb3-a317-65a9de440098", "content": "\u203c CVE-2021-41275 \u203c\n\nspree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an underlying Devise authentication framework. In affected versions spree_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both: Executed whether as: A before_action callback (the default). A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find). Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception). Users are advised to update their spree_auth_devise gem. For users unable to update it may be possible to change your strategy to :exception. Please see the linked GHSA for more workaround details. ### Impact CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both: * Executed whether as: * A before_action callback (the default) * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find). * Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception). That means that applications that haven't been configured differently from what it's generated with Rails aren't affected. Thanks @waiting-for-dev for reporting and providing a patch ? ### Patches Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 ### Workarounds If possible, change your strategy to :exception: ```ruby class ApplicationController < ActionController::Base protect_from_forgery with: :exception end ``` Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller: ```ruby config.after_initialize do Spree::UsersController.protect_from_forgery with: :exception end ``` ### References https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/32557", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-11T17:19:56.220Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}