Moderate severityNVD Advisory· Published Mar 8, 2013· Updated Jun 16, 2026
CVE-2013-1656
CVE-2013-1656
Description
Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the (2) promotion_action parameter to promotion_actions_controller.rb, (3) promotion_rule parameter to promotion_rules_controller.rb, and (4) calculator_type parameter to promotions_controller.rb in promo/app/controllers/spree/admin/, related to unsafe use of the constantize function.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
spreeRubyGems | >= 1.0.0, < 2.0.0.rc1 | 2.0.0.rc1 |
Affected products
24cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*+ 22 more
- cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*range: <=1.3.2
- cpe:2.3:a:spreecommerce:spree:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:spreecommerce:spree:1.3.1:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
11- www.conviso.com.br/advisories/CVE-2013-1656.txtnvdExploit
- spreecommerce.com/blog/multiple-security-vulnerabilities-fixednvdVendor Advisory
- github.com/advisories/GHSA-jxx8-v83v-rhw3ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2013-1656ghsaADVISORY
- blog.convisoappsec.com/en/spree-commerce-multiple-unsafe-reflection-vulnerabilities-cve-2013-1656ghsaWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2013-1656.ymlghsaWEB
- github.com/spree/spree/commit/70092eb55b8be8fe5d21a7658b62da658612fba7ghsaWEB
- web.archive.org/web/20130907044454/https://www.conviso.com.br/advisories/CVE-2013-1656.txtghsaWEB
- web.archive.org/web/20140329142330/http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixedghsaWEB
- web.archive.org/web/20140618100330/http://blog.conviso.com.br/2013/03/spree-commerce-multiple-unsafe.htmlghsaWEB
- blog.conviso.com.br/2013/03/spree-commerce-multiple-unsafe.htmlnvd
News mentions
0No linked articles in our index yet.