关键漏洞信息 漏洞类型 Insecure Direct Object Reference (IDOR) 漏洞描述 描述: Authenticated IDOR via Order Modification. The application did not properly validate address ownership on order updates. 修复: Address ownership validation has been added to prevent unauthorized users from modifying addresses that do not belong to them. 主要修复措施 验证地址所有权: 确保用户只能更新属于自己的地址。 返回422错误: 当用户尝试修改不属于他们的地址时，返回422错误。 漏洞细节 Source Code Changes: Four files were modified to implement the fix. - - - - 相关参考 GitHub Security Advisory: GHSA-g268-72p7-9j6j Issue: #13423 影响版本 Spree versions: v5.2.6 and v5.2.5