CVE-2020-15269

In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory...

CVE-2020-15269 Expired token reuse in Spree

In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory...

CVE-2020-15269

The CVE applies to Spree releases prior to 3.7.11, 4.0.4, and 4.1.11, where expired user tokens could be reused to access Storefront API v2 endpoints. Root cause: expired tokens could authenticate to API v2; patch versions are 3.7.11, 4.0.4, and 4.1.11 (or newer). A workaround without upgrading i...