Authorization bypass in Spree

TRUNG BÌNH 6.5CVE-2020-26223 · GHSA-m2jr-hmc3-qmpr · Công bố 13/11/2020 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2020-26223 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng spree_api, spree (spreecommerce).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.1%, cao hơn 66.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.7.13, 4.0.5, 4.1.12 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
spree_api RubyGems	`≥ 3.7.0, < 3.7.13≥ 4.0.0, < 4.0.5≥ 4.1.0, < 4.1.12`	`3.7.134.0.54.1.12`
spree spreecommerce	`≥ 3.7.0, < 3.7.13≥ 4.0.0, < 4.0.5≥ 4.1.0, < 4.1.12`	`3.7.134.0.54.1.12`

Mô tả

Impact

The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token

Patches

Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.

References

Pull request with a fix and in-depth explanation - https://github.com/spree/spree/pull/10573

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

Mô tả của NVD

Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.