GSD-2010-3978

Vulnerability from gsd - Updated: 2010-11-02 00:00
Details
Spree contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when the application exchanges data using the JSON service without validating requests, which will disclose sensitive user and order information to a context-dependent attacker when a logged-in user visits a crafted website.
Aliases
Aliases
CVE-2010-3978
To clipboard 

{
  "GSD": {
    "alias": "CVE-2010-3978",
    "description": "Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) admin/products.json, (2) admin/users.json, or (3) admin/overview/get_report_data, related to a \"JSON hijacking\" issue.",
    "id": "GSD-2010-3978"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "spree",
            "purl": "pkg:gem/spree"
          }
        }
      ],
      "aliases": [
        "CVE-2010-3978",
        "OSVDB-69098"
      ],
      "details": "Spree contains a flaw that may lead to an unauthorized information\ndisclosure. The issue is triggered when the application exchanges data using\nthe JSON service without validating requests, which will disclose sensitive\nuser and order information to a context-dependent attacker when a logged-in\nuser visits a crafted website.\n",
      "id": "GSD-2010-3978",
      "modified": "2010-11-02T00:00:00.000Z",
      "published": "2010-11-02T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://spreecommerce.com/blog/json-hijacking-vulnerability"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 5.0,
          "type": "CVSS_V2"
        }
      ],
      "summary": "Spree Multiple Script JSON Request Validation Weakness Remote Information\nDisclosure\n"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2010-3978",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) admin/products.json, (2) admin/users.json, or (3) admin/overview/get_report_data, related to a \"JSON hijacking\" issue."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://www.conviso.com.br/json-hijacking-vulnerability/",
            "refsource": "MISC",
            "url": "http://www.conviso.com.br/json-hijacking-vulnerability/"
          },
          {
            "name": "http://spreecommerce.com/blog/2010/11/02/json-hijacking-vulnerability/",
            "refsource": "CONFIRM",
            "url": "http://spreecommerce.com/blog/2010/11/02/json-hijacking-vulnerability/"
          },
          {
            "name": "https://github.com/railsdog/spree/commit/19944bd999c310d9b10d16a41f48ebac97dc4fac",
            "refsource": "CONFIRM",
            "url": "https://github.com/railsdog/spree/commit/19944bd999c310d9b10d16a41f48ebac97dc4fac"
          },
          {
            "name": "http://spreecommerce.com/blog/2010/11/09/spree-0-30-0-released/",
            "refsource": "CONFIRM",
            "url": "http://spreecommerce.com/blog/2010/11/09/spree-0-30-0-released/"
          },
          {
            "name": "https://github.com/railsdog/spree/commit/d881b2bb610ea33e2364ff16feb8e702dfeda135",
            "refsource": "CONFIRM",
            "url": "https://github.com/railsdog/spree/commit/d881b2bb610ea33e2364ff16feb8e702dfeda135"
          },
          {
            "name": "http://www.conviso.com.br/security-advisory-spree-e-commerce-json-v-0-11x/",
            "refsource": "MISC",
            "url": "http://www.conviso.com.br/security-advisory-spree-e-commerce-json-v-0-11x/"
          },
          {
            "name": "http://twitter.com/conviso/statuses/29555076248",
            "refsource": "MISC",
            "url": "http://twitter.com/conviso/statuses/29555076248"
          },
          {
            "name": "20101108 Spree e-commerce JSON Hijacking Vulnerabilities - CVE-2010-3978",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/514674/100/0/threaded"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2010-3978",
      "cvss_v2": 5.0,
      "date": "2010-11-02",
      "description": "Spree contains a flaw that may lead to an unauthorized information\ndisclosure. The issue is triggered when the application exchanges data using\nthe JSON service without validating requests, which will disclose sensitive\nuser and order information to a context-dependent attacker when a logged-in\nuser visits a crafted website.\n",
      "gem": "spree",
      "osvdb": 69098,
      "patched_versions": [
        "~\u003e 0.11.2",
        "\u003e= 0.30.0"
      ],
      "title": "Spree Multiple Script JSON Request Validation Weakness Remote Information\nDisclosure\n",
      "url": "https://spreecommerce.com/blog/json-hijacking-vulnerability"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=0.11.0 \u003c=0.11.1||=0.30.0",
          "affected_versions": "All versions starting from 0.11.0 up to 0.11.1, version 0.30.0",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-200",
            "CWE-937"
          ],
          "date": "2018-10-10",
          "description": "Spree exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) admin/products.json, (2) admin/users.json, or (3) admin/overview/get_report_data, related to a \"JSON hijacking\" issue.",
          "fixed_versions": [
            "0.11.2",
            "0.30.1"
          ],
          "identifier": "CVE-2010-3978",
          "identifiers": [
            "CVE-2010-3978"
          ],
          "not_impacted": "All versions before 0.11.0, all versions after 0.11.1 before 0.30.0, all versions after 0.30.0",
          "package_slug": "gem/spree",
          "pubdate": "2010-11-17",
          "solution": "Upgrade to versions 0.11.2, 0.30.1 or above.",
          "title": "Exposure of Sensitive Information to an Unauthorized Actor",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2010-3978",
            "https://github.com/railsdog/spree/commit/19944bd999c310d9b10d16a41f48ebac97dc4fac",
            "https://github.com/railsdog/spree/commit/d881b2bb610ea33e2364ff16feb8e702dfeda135",
            "http://www.conviso.com.br/security-advisory-spree-e-commerce-json-v-0-11x/",
            "http://spreecommerce.com/blog/2010/11/09/spree-0-30-0-released/",
            "http://spreecommerce.com/blog/2010/11/02/json-hijacking-vulnerability/",
            "http://www.conviso.com.br/json-hijacking-vulnerability/",
            "http://twitter.com/conviso/statuses/29555076248",
            "http://www.securityfocus.com/archive/1/514674/100/0/threaded"
          ],
          "uuid": "f482401b-4654-496a-bd98-74906075d608"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:spreecommerce:spree:0.11.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:spreecommerce:spree:0.11.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:spreecommerce:spree:0.30.0:beta1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2010-3978"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) admin/products.json, (2) admin/users.json, or (3) admin/overview/get_report_data, related to a \"JSON hijacking\" issue."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-200"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/railsdog/spree/commit/19944bd999c310d9b10d16a41f48ebac97dc4fac",
              "refsource": "CONFIRM",
              "tags": [
                "Exploit"
              ],
              "url": "https://github.com/railsdog/spree/commit/19944bd999c310d9b10d16a41f48ebac97dc4fac"
            },
            {
              "name": "https://github.com/railsdog/spree/commit/d881b2bb610ea33e2364ff16feb8e702dfeda135",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://github.com/railsdog/spree/commit/d881b2bb610ea33e2364ff16feb8e702dfeda135"
            },
            {
              "name": "http://www.conviso.com.br/security-advisory-spree-e-commerce-json-v-0-11x/",
              "refsource": "MISC",
              "tags": [],
              "url": "http://www.conviso.com.br/security-advisory-spree-e-commerce-json-v-0-11x/"
            },
            {
              "name": "http://spreecommerce.com/blog/2010/11/09/spree-0-30-0-released/",
              "refsource": "CONFIRM",
              "tags": [
                "Patch"
              ],
              "url": "http://spreecommerce.com/blog/2010/11/09/spree-0-30-0-released/"
            },
            {
              "name": "http://spreecommerce.com/blog/2010/11/02/json-hijacking-vulnerability/",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://spreecommerce.com/blog/2010/11/02/json-hijacking-vulnerability/"
            },
            {
              "name": "http://www.conviso.com.br/json-hijacking-vulnerability/",
              "refsource": "MISC",
              "tags": [],
              "url": "http://www.conviso.com.br/json-hijacking-vulnerability/"
            },
            {
              "name": "http://twitter.com/conviso/statuses/29555076248",
              "refsource": "MISC",
              "tags": [],
              "url": "http://twitter.com/conviso/statuses/29555076248"
            },
            {
              "name": "20101108 Spree e-commerce JSON Hijacking Vulnerabilities - CVE-2010-3978",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/514674/100/0/threaded"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2018-10-10T20:06Z",
      "publishedDate": "2010-11-17T16:00Z"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.