GitHub Advisoryadvisory · RubyGems

GHSA-m2jr-hmc3-qmpr Authorization bypass in Spree

HIGH Published 2020-11-13 Modified 2023-05-16 Official page ↗
Aliases
CVE-2020-26223
Ecosystem
RubyGems
Packages
spree_api
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-863
Reviewed
2020-11-13

Affected packages

• RubyGems spree_api: >= 3.7.0, < 3.7.13 → fixed in 3.7.13 • RubyGems spree_api: >= 4.0.0, < 4.0.5 → fixed in 4.0.5 • RubyGems spree_api: >= 4.1.0, < 4.1.12 → fixed in 4.1.12

Description

Impact The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token Patches Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected. References Pull request with a fix and in-depth explanation - https://github.com/spree/spree/pull/10573 For more information If you have any questions or comments about this advisory: • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2020-26223 Spree is a complete open source e-commerce solution built with Ruby on Rails. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References