Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 17/11/2010 Updated: 10/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Spree 0.11.x prior to 0.11.2 and 0.30.x prior to 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote malicious users to obtain sensitive information via vectors involving (1) admin/products.json, (2) admin/users.json, or (3) admin/overview/get_report_data, related to a "JSON hijacking" issue.

Vulnerable Product	Search on Vulmon	Subscribe to Product
spreecommerce spree 0.11.0
spreecommerce spree 0.11.1
spreecommerce spree 0.30.0

CWE-200 https://github.com/railsdog/spree/commit/19944bd999c310d9b10d16a41f48ebac97dc4fac https://github.com/railsdog/spree/commit/d881b2bb610ea33e2364ff16feb8e702dfeda135 http://www.conviso.com.br/security-advisory-spree-e-commerce-json-v-0-11x/http://spreecommerce.com/blog/2010/11/09/spree-0-30-0-released/http://spreecommerce.com/blog/2010/11/02/json-hijacking-vulnerability/http://www.conviso.com.br/json-hijacking-vulnerability/http://twitter.com/conviso/statuses/29555076248 http://www.securityfocus.com/archive/1/514674/100/0/threaded https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2010-3978

Vulnerability Summary

References

Vulmon Search

About

Products

Connect