GHSA-7H48-M3RW-VR27 Spree does not properly restrict the use of a hash to provide values for a model's attributes

🗓️ 17 May 2022 05:31:08Reported by GoogleType

osv

osv🔗 osv.dev👁 16 Views

Spree 0.2.0 model attributes hash vulnerabilit

Reporter	Title	Published	Views	Family All 8
CVE	CVE-2008-7310	4 Apr 201222:00	–	cve
Cvelist	CVE-2008-7310	4 Apr 201222:00	–	cvelist
EUVD	EUVD-2022-3007	3 Oct 202520:07	–	euvd
Github Security Blog	Spree does not properly restrict the use of a hash to provide values for a model's attributes	17 May 202205:31	–	github
NVD	CVE-2008-7310	5 Apr 201213:25	–	nvd
Prion	Security feature bypass	5 Apr 201213:25	–	prion
RedhatCVE	CVE-2008-7310	21 May 202520:10	–	redhatcve
RubySec	Spree Hash Restriction Weakness URL Parsing Order State Value Manipulation	22 Sep 200800:00	–	rubygems

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2008-7310
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2008-7310.yml
github	www.github.com/spree/spree
spreecommerce	www.spreecommerce.com/blog/security-vulnerability-mass-assignment
web	www.web.archive.org/web/20080925003904/http://railspikes.com/2008/9/22/is-your-rails-application-safe-from-mass-assignment
web	www.web.archive.org/web/20101128024717/http://spreecommerce.com/blog/2008/09/16/security-vulnerability-mass-assignment-of-order-params
railspikes	www.railspikes.com/2008/9/22/is-your-rails-application-safe-from-mass-assignment
spreecommerce	www.spreecommerce.com/blog/2008/09/16/security-vulnerability-mass-assignment-of-order-params

07 Dec 2024 05:41Current

6.4Medium risk

Vulners AI Score6.4

CVSS 25

EPSS0.01244

spree 0.2.0 model attributes remote attackers mass assignment