Search criteria

3 vulnerabilities found for spree by sparksolutions

FKIE_CVE-2020-15269

Vulnerability from fkie_nvd - Published: 2020-10-20 21:15 - Updated: 2024-11-21 05:05
Summary
In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.
Impacted products

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sparksolutions:spree:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E26F2607-9260-4AA3-A636-3D5EB219CB3A",
              "versionEndExcluding": "3.7.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sparksolutions:spree:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7B96C57-83B7-4975-A978-64488EC00415",
              "versionEndExcluding": "4.0.4",
              "versionStartIncluding": "4.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sparksolutions:spree:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1636D8F5-D862-4F97-B6E8-28D1874A4826",
              "versionEndExcluding": "4.1.11",
              "versionStartIncluding": "4.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory."
    },
    {
      "lang": "es",
      "value": "En Spree versiones anteriores a 3.7.11, 4.0.4 o 4.1.11, los tokens de usuario vencidos podr\u00edan ser usados para acceder a los endpoints de Storefront API versi\u00f3n v2.\u0026#xa0;El problema est\u00e1 parcheado en las versiones 3.7.11, 4.0.4 y 4.1.11.\u0026#xa0;Una soluci\u00f3n alternativa sin actualizar es descrita en el aviso vinculado"
    }
  ],
  "id": "CVE-2020-15269",
  "lastModified": "2024-11-21T05:05:14.067",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 6.4,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-10-20T21:15:12.743",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        },
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2020-15269 (GCVE-0-2020-15269)

Vulnerability from cvelistv5 – Published: 2020-10-20 20:15 – Updated: 2024-08-04 13:15
VLAI?
Title
Expired token reuse in Spree
Summary
In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.
CWE
  • CWE-287 - {"CWE-287":"Improper Authentication"}
  • CWE-613 - {"CWE-613":"Insufficient Session Expiration"}
Assigner
Impacted products
Vendor Product Version
spree spree Affected: < 3.7.11
Affected: >= 4.0.0, < 4.0.4
Affected: >= 4.1.0, < 4.1.11
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:15:18.944Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "spree",
          "vendor": "spree",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.7.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.1.0, \u003c 4.1.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "{\"CWE-287\":\"Improper Authentication\"}",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "{\"CWE-613\":\"Insufficient Session Expiration\"}",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-20T20:15:14",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847"
        }
      ],
      "source": {
        "advisory": "GHSA-f8cm-364f-q9qh",
        "discovery": "UNKNOWN"
      },
      "title": "Expired token reuse in Spree",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15269",
          "STATE": "PUBLIC",
          "TITLE": "Expired token reuse in Spree"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "spree",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 3.7.11"
                          },
                          {
                            "version_value": "\u003e= 4.0.0, \u003c 4.0.4"
                          },
                          {
                            "version_value": "\u003e= 4.1.0, \u003c 4.1.11"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "spree"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "{\"CWE-287\":\"Improper Authentication\"}"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "{\"CWE-613\":\"Insufficient Session Expiration\"}"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh",
              "refsource": "CONFIRM",
              "url": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh"
            },
            {
              "name": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847",
              "refsource": "MISC",
              "url": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-f8cm-364f-q9qh",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-15269",
    "datePublished": "2020-10-20T20:15:14",
    "dateReserved": "2020-06-25T00:00:00",
    "dateUpdated": "2024-08-04T13:15:18.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-15269 (GCVE-0-2020-15269)

Vulnerability from nvd – Published: 2020-10-20 20:15 – Updated: 2024-08-04 13:15
VLAI?
Title
Expired token reuse in Spree
Summary
In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.
CWE
  • CWE-287 - {"CWE-287":"Improper Authentication"}
  • CWE-613 - {"CWE-613":"Insufficient Session Expiration"}
Assigner
Impacted products
Vendor Product Version
spree spree Affected: < 3.7.11
Affected: >= 4.0.0, < 4.0.4
Affected: >= 4.1.0, < 4.1.11
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:15:18.944Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "spree",
          "vendor": "spree",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.7.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.1.0, \u003c 4.1.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "{\"CWE-287\":\"Improper Authentication\"}",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "{\"CWE-613\":\"Insufficient Session Expiration\"}",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-20T20:15:14",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847"
        }
      ],
      "source": {
        "advisory": "GHSA-f8cm-364f-q9qh",
        "discovery": "UNKNOWN"
      },
      "title": "Expired token reuse in Spree",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15269",
          "STATE": "PUBLIC",
          "TITLE": "Expired token reuse in Spree"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "spree",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 3.7.11"
                          },
                          {
                            "version_value": "\u003e= 4.0.0, \u003c 4.0.4"
                          },
                          {
                            "version_value": "\u003e= 4.1.0, \u003c 4.1.11"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "spree"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "{\"CWE-287\":\"Improper Authentication\"}"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "{\"CWE-613\":\"Insufficient Session Expiration\"}"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh",
              "refsource": "CONFIRM",
              "url": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh"
            },
            {
              "name": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847",
              "refsource": "MISC",
              "url": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-f8cm-364f-q9qh",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-15269",
    "datePublished": "2020-10-20T20:15:14",
    "dateReserved": "2020-06-25T00:00:00",
    "dateUpdated": "2024-08-04T13:15:18.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}