{"action":"Upgrade solidus_backend to 2.11.16 or later.","affected":[{"fixed":"2.11.16","introduced":"0"},{"fixed":"3.0.6","introduced":"3.0.0"},{"fixed":"3.1.6","introduced":"3.1.0"}],"component":"solidus_backend","cve_ids":["CVE-2022-31000"],"ecosystem":"RubyGems","epss":0.00413,"exploited":false,"fixed_versions":["2.11.16","3.0.6","3.1.6"],"ghsa_id":"GHSA-8639-qx56-r428","id":"tcs_01M5KEHWDWKYWY05NXW1AB846P","modified_at":"2023-11-08T04:09:22.169642Z","published_at":"2022-06-01T20:26:37Z","references":["https://osv.dev/vulnerability/GHSA-8639-qx56-r428","https://github.com/solidusio/solidus/security/advisories/GHSA-8639-qx56-r428","https://nvd.nist.gov/vuln/detail/CVE-2022-31000","https://github.com/solidusio/solidus/commit/de796a2e0be7f154cae48b46e267501559d9716c","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/solidus_backend/CVE-2022-31000.yml","https://github.com/solidusio/solidus"],"severity":{"label":"low","score":2.3},"sources":[{"source":"osv","source_id":"GHSA-8639-qx56-r428","url":"https://osv.dev/vulnerability/GHSA-8639-qx56-r428"}],"summary":"CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend"}