PT-2020-14327 · Spree Commerce · Spree

Damianlegawiec · Published 2020-10-20 · Updated 2021-11-18 · CVE-2020-15269

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Spree versions prior to 3.7.11 Spree versions prior to 4.0.4 Spree versions prior to 4.1.11

Description The issue allows expired user tokens to be used for accessing Storefront API v2 endpoints. This could be exploited by a perpetrator who previously obtained an old expired user token.

Recommendations For versions prior to 3.7.11, upgrade to version 3.7.11. For versions prior to 4.0.4, upgrade to version 4.0.4. For versions prior to 4.1.11, upgrade to version 4.1.11. As a temporary workaround without upgrading, create a decorator file app/controllers/spree/api/v2/base controller decorator.rb with the specified contents to override the spree current user method in Spree::Api::V2::BaseController.

Exploit

Fix

Improper Authentication

Insufficient Session Expiration

Weakness Enumeration

CWE-287

CWE-613

Related Identifiers

CVE-2020-15269

GHSA-F8CM-364F-Q9QH

Affected Products

Spree

References · 7

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2020-15269.yml · Exploit
• https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15269 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15269 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f8cm-364f-q9qh · Vendor Advisory
• https://github.com/spree/spree · Note
• https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh · Note