CVE-2020-26223
In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability.
Does this matter?
Lower severity and a low EPSS score (1.12%). Track it; it rarely justifies an emergency change on its own.
Description
Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.12% probability · 64th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-863
- Affected
- spreecommerce/spree
- Source
- security-advisories@github.com
References
- https://github.com/spree/spree/pull/10573Exploit, Patch, Third Party Advisory
- https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmprThird Party Advisory
- https://guides.spreecommerce.org/api/v2/storefront#tag/Order-StatusVendor Advisory
- https://github.com/spree/spree/pull/10573Exploit, Patch, Third Party Advisory
- https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmprThird Party Advisory
- https://guides.spreecommerce.org/api/v2/storefront#tag/Order-StatusVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.