CVE-2020-26223 (GCVE-0-2020-26223)
Vulnerability from cvelistv5
Published
2020-11-13 17:25
Modified
2024-08-04 15:49
Severity ?
7.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE
  • CWE-863 - Incorrect Authorization
Summary
Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.
References
security-advisories@github.comhttps://github.com/spree/spree/pull/10573Exploit, Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmprThird Party Advisory
security-advisories@github.comhttps://guides.spreecommerce.org/api/v2/storefront#tag/Order-StatusVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/spree/spree/pull/10573Exploit, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmprThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://guides.spreecommerce.org/api/v2/storefront#tag/Order-StatusVendor Advisory
Impacted products
Vendor Product Version
spree spree Version: >= 3.7.0, < 3.7.13
Version: >= 4.0.0, < 4.0.5
Version: >= 4.1.0, < 4.1.12
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:49:07.219Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/spree/spree/pull/10573"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "spree",
          "vendor": "spree",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.7.0, \u003c 3.7.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.1.0, \u003c 4.1.12"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree \u003c 3.7 are not affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-13T17:25:20",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/spree/spree/pull/10573"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status"
        }
      ],
      "source": {
        "advisory": "GHSA-m2jr-hmc3-qmpr",
        "discovery": "UNKNOWN"
      },
      "title": "Authorization bypass in Spree",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-26223",
          "STATE": "PUBLIC",
          "TITLE": "Authorization bypass in Spree"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "spree",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 3.7.0, \u003c 3.7.13"
                          },
                          {
                            "version_value": "\u003e= 4.0.0, \u003c 4.0.5"
                          },
                          {
                            "version_value": "\u003e= 4.1.0, \u003c 4.1.12"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "spree"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree \u003c 3.7 are not affected."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-863: Incorrect Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr",
              "refsource": "CONFIRM",
              "url": "https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr"
            },
            {
              "name": "https://github.com/spree/spree/pull/10573",
              "refsource": "MISC",
              "url": "https://github.com/spree/spree/pull/10573"
            },
            {
              "name": "https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status",
              "refsource": "MISC",
              "url": "https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-m2jr-hmc3-qmpr",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-26223",
    "datePublished": "2020-11-13T17:25:20",
    "dateReserved": "2020-10-01T00:00:00",
    "dateUpdated": "2024-08-04T15:49:07.219Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2020-26223\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2020-11-13T18:15:12.777\",\"lastModified\":\"2024-11-21T05:19:34.637\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree \u003c 3.7 are not affected.\"},{\"lang\":\"es\",\"value\":\"Spree es una completa soluci\u00f3n e-commerce de c\u00f3digo abierto construida con Ruby on Rails.\u0026#xa0;En Spree desde la versi\u00f3n 3.7 y versiones anteriores a 3.7.13, 4.0.5 y 4.1.12, se presenta una vulnerabilidad de omisi\u00f3n de autorizaci\u00f3n.\u0026#xa0;El perpetrador podr\u00eda consultar el endpoint API v2 Order Status con una cadena vac\u00eda pasada como un token de pedido.\u0026#xa0;Esto est\u00e1 parcheado en versiones 3.7.11, 4.0.4 o 4.1.11 dependiendo de la versi\u00f3n de Spree usada.\u0026#xa0;Los usuarios de Spree versiones anteriores a 3.7 no est\u00e1n afectados\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":7.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.1,\"impactScore\":4.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:N/A:N\",\"baseScore\":4.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.7.0\",\"versionEndExcluding\":\"3.7.13\",\"matchCriteriaId\":\"4F0DFB4E-3D62-4C6C-A227-3B839055F34C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.0.0\",\"versionEndExcluding\":\"4.0.5\",\"matchCriteriaId\":\"B10057D2-194D-4019-A8F3-9A64E3BAFE70\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:spreecommerce:spree:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.1.0\",\"versionEndExcluding\":\"4.1.12\",\"matchCriteriaId\":\"95279953-3BEB-454E-8C60-F4E00602849B\"}]}]}],\"references\":[{\"url\":\"https://github.com/spree/spree/pull/10573\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/spree/spree/pull/10573\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.