CVE-2020-15269
20.10.2020, 21:15
In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.Enginsight
| Vendor | Product | Version |
|---|---|---|
| sparksolutions | spree | 𝑥 < 3.7.11 |
| sparksolutions | spree | 4.0.0 ≤ 𝑥 < 4.0.4 |
| sparksolutions | spree | 4.1.0 ≤ 𝑥 < 4.1.11 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-287 - Improper AuthenticationWhen an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
- CWE-613 - Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
References