Lucene search

RubySecRUBY:SPREE-2008-7310-81505

HistorySep 21, 2008 - 8:00 p.m.

Spree Hash Restriction Weakness URL Parsing Order State Value Manipulation

2008-09-2120:00:00

RubySec

rubysec.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

Spree contains a hash restriction weakness that occurs when parsing a
modified URL. This may allow an attacker to manipulate order state values.

Affected configurations

Vulners

Node

rubyspreeRange<0.3.0

VendorProductVersionCPE
rubyspree*cpe:2.3:a:ruby:spree:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ruby	spree	*	cpe:2.3:a:ruby:spree::::::::

spreecommerce.com/blog/security-vulnerability-mass-assignment

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

Related for RUBY:SPREE-2008-7310-81505