{"metadata": {"vulnerability": "cve-2021-41275", "count": 18, "kinds": {"milestone": 5, "sighting": 1, "kev": 0, "other": 12}}, "data": [{"timestamp": "2021-09-15T00:00:00Z", "date_only": false, "value": "2021-09-15T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2021-41275", "field": "cveMetadata.dateReserved"}, {"timestamp": "2021-11-17T00:00:00Z", "date_only": true, "value": "2021-11-17", "kind": "other", "label": "Pubdate", "source": "gsd \u00b7 GSD-2021-41275", "record": "GSD-2021-41275", "field": "namespaces.gitlab.com.advisories.0.pubdate"}, {"timestamp": "2021-11-17T19:50:11Z", "date_only": false, "value": "2021-11-17T19:50:11.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2021-41275", "field": "cveMetadata.datePublished"}, {"timestamp": "2021-11-17T19:50:11Z", "date_only": false, "value": "2021-11-17T19:50:11.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2021-41275", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2021-11-17T20:15:00Z", "date_only": false, "value": "2021-11-17T20:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-26XX-M4Q2-XHQ8", "record": "GHSA-26XX-M4Q2-XHQ8", "field": "database_specific.nvd_published_at"}, {"timestamp": "2021-11-17T20:15:00Z", "date_only": false, "value": "2021-11-17T20:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2021-41275", "record": "GSD-2021-41275", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2021-11-17T20:15:10.527Z", "date_only": false, "value": "2021-11-17T20:15:10.527", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-41275", "record": "FKIE_CVE-2021-41275", "field": "published"}, {"timestamp": "2021-11-17T22:15:07Z", "date_only": false, "value": "2021-11-17T22:15:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cibsecurity/32557", "record": "CVE-2021-41275", "field": "creation_timestamp", "uuid": "50f61aee-5dd6-4cc4-9e68-622d3f5370ae", "content": "\u203c CVE-2021-41275 \u203c\n\nspree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an underlying Devise authentication framework. In affected versions spree_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both: Executed whether as: A before_action callback (the default). A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find). Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception). Users are advised to update their spree_auth_devise gem. For users unable to update it may be possible to change your strategy to :exception. Please see the linked GHSA for more workaround details. ### Impact CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both: * Executed whether as: * A before_action callback (the default) * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find). * Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception). That means that applications that haven't been configured differently from what it's generated with Rails aren't affected. Thanks @waiting-for-dev for reporting and providing a patch ? ### Patches Spree 4.3 users should update to spree_auth_devise 4.4.1 Spree 4.2 users should update to spree_auth_devise 4.2.1 ### Workarounds If possible, change your strategy to :exception: ```ruby class ApplicationController < ActionController::Base protect_from_forgery with: :exception end ``` Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller: ```ruby config.after_initialize do Spree::UsersController.protect_from_forgery with: :exception end ``` ### References https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/32557"}, {"timestamp": "2021-11-18T00:00:00Z", "date_only": true, "value": "2021-11-18", "kind": "other", "label": "Date", "source": "gsd \u00b7 GSD-2021-41275", "record": "GSD-2021-41275", "field": "namespaces.github.com/rubysec/ruby-advisory-db.date"}, {"timestamp": "2021-11-18T00:00:00Z", "date_only": false, "value": "2021-11-18T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "gsd \u00b7 GSD-2021-41275", "record": "GSD-2021-41275", "field": "gsd.osvSchema.published"}, {"timestamp": "2021-11-18T00:00:00Z", "date_only": false, "value": "2021-11-18T00:00:00.000Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-41275", "record": "GSD-2021-41275", "field": "gsd.osvSchema.modified"}, {"timestamp": "2021-11-18T20:14:19Z", "date_only": false, "value": "2021-11-18T20:14:19Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-26XX-M4Q2-XHQ8", "record": "GHSA-26XX-M4Q2-XHQ8", "field": "published"}, {"timestamp": "2023-03-01T00:00:00Z", "date_only": true, "value": "2023-03-01", "kind": "other", "label": "Date", "source": "gsd \u00b7 GSD-2021-41275", "record": "GSD-2021-41275", "field": "namespaces.gitlab.com.advisories.0.date"}, {"timestamp": "2023-03-01T18:58:00Z", "date_only": false, "value": "2023-03-01T18:58Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2021-41275", "record": "GSD-2021-41275", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2024-08-04T03:08:31.652Z", "date_only": false, "value": "2024-08-04T03:08:31.652Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2021-41275", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-08-04T03:08:31.652Z", "date_only": false, "value": "2024-08-04T03:08:31.652Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "cve-2021-41275", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-07-01T17:28:05Z", "date_only": false, "value": "2025-07-01T17:28:05Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-26XX-M4Q2-XHQ8", "record": "GHSA-26XX-M4Q2-XHQ8", "field": "modified"}, {"timestamp": "2026-06-17T04:08:13.250Z", "date_only": false, "value": "2026-06-17T04:08:13.250", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-41275", "record": "FKIE_CVE-2021-41275", "field": "lastModified"}]}