Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address information without supplying valid credentials or session cookies. This issue has been patched in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSpreecommerce Spree
APPSpreecommerce< 4.10.25.0.0 – 5.0.7 (bez)5.1.0 – 5.1.9 (bez)5.2.0 – 5.2.5 (bez)
Related vulnerabilities
RCE via command injection w API wyszukiwania Spreecommerce Spree
RCE w Spreecommerce Spree — brak sanitizacji parametru wyszukiwania
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, ...
Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in ...
Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and be...