Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Authorization bypass in Spree
Vulnerability Description
Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Vulnerability Type
授权机制不正确
Vulnerability Title
Spree 安全漏洞
Vulnerability Description
Spree是个人开发者的一款采用Ruby on Rails开发的开源商城。 Spree 3.7版本至3.7.13版本, 4.0.5版本, 4.1.12版本存在安全漏洞，该漏洞源于存在一个授权绕过漏洞。攻击者可利用该漏洞使用一个作为订单令牌传递的空字符串查询API v2订单状态端点。
CVSS Information
N/A
Vulnerability Type
N/A