Spree Improper Input Validation vulnerability

🗓️ 24 Oct 2017 18:33:37Reported by GitHub Advisory DatabaseType

Spree Commerce 1.0.x before 2.0.0.rc1 improper input validation vulnerability allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands

Reporter	Title	Published	Views	Family All 11
CVE	CVE-2013-1656	8 Mar 201318:00	–	cve
Cvelist	CVE-2013-1656	8 Mar 201318:00	–	cvelist
EUVD	EUVD-2017-0268	7 Oct 202500:30	–	euvd
NVD	CVE-2013-1656	8 Mar 201318:55	–	nvd
OSV	GHSA-JXX8-V83V-RHW3 Spree Improper Input Validation vulnerability	24 Oct 201718:33	–	osv
Prion	Code injection	8 Mar 201318:55	–	prion
RubySec	Spree controller Parameter Arbitrary Ruby Object Instantiation Command Execution	21 Feb 201300:00	–	rubygems
RubySec	Spree promotion_actions_controller.rb promotion_action Parameter Arbitrary Ruby Object Instantiation Command Execution	21 Feb 201300:00	–	rubygems
RubySec	Spree payment_methods_controller.rb payment_method Parameter Arbitrary Ruby Object Instantiation Command Execution	21 Feb 201300:00	–	rubygems
RubySec	Spree promotions_controller.rb calculator_type Parameter Arbitrary Ruby Object Instantiation Command Execution	21 Feb 201300:00	–	rubygems

Vulners

Node

spreecommerce spreeRange1.0.0–2.0.0.rc1rubygems

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2013-1656
web	www.web.archive.org/web/20130907044454/https://www.conviso.com.br/advisories/CVE-2013-1656.txt
web	www.web.archive.org/web/20140329142330/http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
web	www.web.archive.org/web/20140618100330/http://blog.conviso.com.br/2013/03/spree-commerce-multiple-unsafe.html
github	www.github.com/spree/spree/commit/70092eb55b8be8fe5d21a7658b62da658612fba7
blog	www.blog.convisoappsec.com/en/spree-commerce-multiple-unsafe-reflection-vulnerabilities-cve-2013-1656
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2013-1656.yml
github	www.github.com/advisories/GHSA-jxx8-v83v-rhw3

05 Nov 2023 05:05Current

7High risk

Vulners AI Score7

CVSS 24.3

EPSS0.00305

CWE-20