CVE-2020-26223

moderate-risk
Published 2020-11-13

Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.

Do I need to act?

-
0.27% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.7/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Spreecommerce

References (6)

Exploit https://github.com/spree/spree/pull/10573
Third Party Advisory https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr
Vendor Advisory https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status
Exploit https://github.com/spree/spree/pull/10573
Third Party Advisory https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr
Vendor Advisory https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status
33
/ 100
moderate-risk
Severity 27/34 · High
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal