CVEvulnerability
CVE-2008-7311
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-04-05
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-255
Description
The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the config/environment.rb file.
Affected configurations
• spreecommerce spree 0.2.0
Related
Weakness · not in database (1)
References
- http://spreecommerce.com/blog/2008/08/12/security-vulernability-session-cookie-store/ Vendor Advisory
- http://support.spreehq.org/issues/show/63 support.spreehq.org
- http://spreecommerce.com/blog/2008/08/12/security-vulernability-session-cookie-store/ Vendor Advisory
- http://support.spreehq.org/issues/show/63 support.spreehq.org