RubyGems package
spree
pkg:gem/spree
Vulnerabilities (7)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2011-10026 | — | >= 0.30.0.beta1, < 0.50.0 | 0.50.0 | Aug 20, 2025 | Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows attackers to inject arbitrary shell commands via the search[instance_eval] parameter, which is dynamically invoked using Rub | ||
| CVE-2011-10019 | — | < 0.60.2 | 0.60.2 | Aug 13, 2025 | Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attac | ||
| CVE-2020-15269 | — | < 3.7.11 | 3.7.11 | Oct 20, 2020 | In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory. | ||
| CVE-2013-1656 | — | >= 1.0.0, < 2.0.0.rc1 | 2.0.0.rc1 | Mar 8, 2013 | Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the (2) promotion_action | ||
| CVE-2008-7311 | — | < 0.4.0 | 0.4.0 | Apr 5, 2012 | The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value wit | ||
| CVE-2008-7310 | — | < 0.4.0 | 0.4.0 | Apr 5, 2012 | Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability. | ||
| CVE-2010-3978 | — | >= 0.11.0, < 0.11.2 | 0.11.2 | Nov 17, 2010 | Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) admin/products.json, (2) admin/users.jso |
- CVE-2011-10026Aug 20, 2025affected >= 0.30.0.beta1, < 0.50.0fixed 0.50.0
Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows attackers to inject arbitrary shell commands via the search[instance_eval] parameter, which is dynamically invoked using Rub
- CVE-2011-10019Aug 13, 2025affected < 0.60.2fixed 0.60.2
Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attac
- CVE-2020-15269Oct 20, 2020affected < 3.7.11fixed 3.7.11
In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.
- CVE-2013-1656Mar 8, 2013affected >= 1.0.0, < 2.0.0.rc1fixed 2.0.0.rc1
Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the (2) promotion_action
- CVE-2008-7311Apr 5, 2012affected < 0.4.0fixed 0.4.0
The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value wit
- CVE-2008-7310Apr 5, 2012affected < 0.4.0fixed 0.4.0
Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability.
- CVE-2010-3978Nov 17, 2010affected >= 0.11.0, < 0.11.2fixed 0.11.2
Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) admin/products.json, (2) admin/users.jso