Information Exposure Affecting spree package, versions < 0.30.0, >= 0.12 < 0.11.2
Snyk CVSS
Attack Complexity
Low
Threat Intelligence
EPSS
0.67% (80th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-SPREE-20011
- published 1 Nov 2010
- disclosed 1 Nov 2010
- credit Gabriel Quadros
Introduced: 1 Nov 2010
CVE-2010-3978 Open this link in a new tabOverview
Spree is an open source e-commerce framework for Ruby on Rails.
Spree contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when the application exchanges data using the JSON service without validating requests, which will disclose sensitive user and order information to a context-dependent attacker when a logged-in user visits a crafted website.