{"containers": {"cna": {"affected": [{"product": "spree", "vendor": "spree", "versions": [{"status": "affected", "version": ">= 3.7.0, < 3.7.13"}, {"status": "affected", "version": ">= 4.0.0, < 4.0.5"}, {"status": "affected", "version": ">= 4.1.0, < 4.1.12"}]}], "descriptions": [{"lang": "en", "value": "Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-11-13T17:25:20", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/spree/spree/pull/10573"}, {"tags": ["x_refsource_MISC"], "url": "https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status"}], "source": {"advisory": "GHSA-m2jr-hmc3-qmpr", "discovery": "UNKNOWN"}, "title": "Authorization bypass in Spree", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2020-26223", "STATE": "PUBLIC", "TITLE": "Authorization bypass in Spree"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "spree", "version": {"version_data": [{"version_value": ">= 3.7.0, < 3.7.13"}, {"version_value": ">= 4.0.0, < 4.0.5"}, {"version_value": ">= 4.1.0, < 4.1.12"}]}}]}, "vendor_name": "spree"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-863: Incorrect Authorization"}]}]}, "references": {"reference_data": [{"name": "https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr", "refsource": "CONFIRM", "url": "https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr"}, {"name": "https://github.com/spree/spree/pull/10573", "refsource": "MISC", "url": "https://github.com/spree/spree/pull/10573"}, {"name": "https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status", "refsource": "MISC", "url": "https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status"}]}, "source": {"advisory": "GHSA-m2jr-hmc3-qmpr", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T15:49:07.219Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/spree/spree/pull/10573"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2020-26223", "datePublished": "2020-11-13T17:25:20", "dateReserved": "2020-10-01T00:00:00", "dateUpdated": "2024-08-04T15:49:07.219Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*", "matchCriteriaId": "4F0DFB4E-3D62-4C6C-A227-3B839055F34C", "versionEndExcluding": "3.7.13", "versionStartIncluding": "3.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*", "matchCriteriaId": "B10057D2-194D-4019-A8F3-9A64E3BAFE70", "versionEndExcluding": "4.0.5", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*", "matchCriteriaId": "95279953-3BEB-454E-8C60-F4E00602849B", "versionEndExcluding": "4.1.12", "versionStartIncluding": "4.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected."}, {"lang": "es", "value": "Spree es una completa soluci\u00f3n e-commerce de c\u00f3digo abierto construida con Ruby on Rails.&#xa0;En Spree desde la versi\u00f3n 3.7 y versiones anteriores a 3.7.13, 4.0.5 y 4.1.12, se presenta una vulnerabilidad de omisi\u00f3n de autorizaci\u00f3n.&#xa0;El perpetrador podr\u00eda consultar el endpoint API v2 Order Status con una cadena vac\u00eda pasada como un token de pedido.&#xa0;Esto est\u00e1 parcheado en versiones 3.7.11, 4.0.4 o 4.1.11 dependiendo de la versi\u00f3n de Spree usada.&#xa0;Los usuarios de Spree versiones anteriores a 3.7 no est\u00e1n afectados"}], "id": "CVE-2020-26223", "lastModified": "2024-11-21T05:19:34.637", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-11-13T18:15:12.777", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://github.com/spree/spree/pull/10573"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://github.com/spree/spree/pull/10573"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}