Vulnerability · Published Oct 20, 2020 · Assigned by GitHub_M
CVE-2020-15269Expired token reuse in Spree
High 7.4
In plain English
A high-severity improper authentication in spree from spree. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)1.1%top 35.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| RubyGems | spree | 3.7.11 | GHSA-f8cm-364f-q9qh |
| RubyGems | spree | 4.0.4 | GHSA-f8cm-364f-q9qh |
| RubyGems | spree | 4.1.11 | GHSA-f8cm-364f-q9qh |
Affected products (as reported)
Weakness: CWE-287, CWE-613 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh x_refsource_CONFIRM
- https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847 x_refsource_MISC