CVE-2020-15269

2020-10-2021:15:12

Google

osv.dev

9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

51.0%

JSON

In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.

CPENameOperatorVersion
spreeeq4.1.6
spreeeq4.1.8
spreeeq4.1.2
spreeeq4.1.10
spreeeq4.1.5
spreeeq4.1.4
spreeeq4.1.7
spreeeq4.1.9
spreeeq4.1.1
spreeeq4.1.3