CVE-2020-26223

Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Ord...

PT-2020-16352

Name of the Vulnerable Software and Affected Versions Spree versions prior to 3.7.11 Spree versions 3.7.11 through 3.7.12 are not affected, but versions prior to 3.7.11 are. However, considering the broader range, we can simplify to: Spree versions prior to 3.7.11 Spree versions 4.0.0 through 4.0...