Information Exposure Affecting spree Open this link in a new tab package, versions < 0.30.0, >= 0.12 < 0.11.2


0.0
medium
  • Attack Complexity

    Low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-RUBY-SPREE-20011

  • published

    1 Nov 2010

  • disclosed

    1 Nov 2010

  • credit

    Gabriel Quadros

Overview

Spree is an open source e-commerce framework for Ruby on Rails.

Spree contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when the application exchanges data using the JSON service without validating requests, which will disclose sensitive user and order information to a context-dependent attacker when a logged-in user visits a crafted website.