Lucene search

GitHub Advisory DatabaseGHSA-7H48-M3RW-VR27

HistoryMay 17, 2022 - 5:31 a.m.

Spree does not properly restrict the use of a hash to provide values for a model's attributes

2022-05-1705:31:08

GitHub Advisory Database

github.com

spree 0.2.0

hash restriction

remote attackers

mass assignment

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

0.001

Percentile

48.4%

JSON

Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model’s attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a “mass assignment” vulnerability.

Affected configurations

Vulners

Node

spreespreeRange<0.4.0

References

railspikes.com/2008/9/22/is-your-rails-application-safe-from-mass-assignment

spreecommerce.com/blog/2008/09/16/security-vulnerability-mass-assignment-of-order-params/

github.com/advisories/GHSA-7h48-m3rw-vr27

github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2008-7310.yml

nvd.nist.gov/vuln/detail/CVE-2008-7310

spreecommerce.com/blog/security-vulnerability-mass-assignment

web.archive.org/web/20080925003904/railspikes.com/2008/9/22/is-your-rails-application-safe-from-mass-assignment

web.archive.org/web/20101128024717/spreecommerce.com/blog/2008/09/16/security-vulnerability-mass-assignment-of-order-params/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

0.001

Percentile

48.4%

JSON

Related for GHSA-7H48-M3RW-VR27