by Kastro
Paper/Archive/CVE-2020-15269

CVE-2020-15269

spree spree — Expired token reuse in Spree

EPSS 1%CVSS 9.1
critical.is priorityof 100
40
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 64.7.647 × 2012.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.

Affected

ProductAffectedFixed inSource
spree< 3.7.11–CNA
spree>= 4.0.0, < 4.0.4–CNA
spree>= 4.1.0, < 4.1.11–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub_M (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refgithub.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qhrefgithub.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847