Unauthenticated Spree Commerce users can view completed guest orders by Order ID
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.7epss 0.4%
probabilidad de explotación
0.4%top 64% de las CVE
explotación observada
noninguna fuente lo reporta
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view completed guest orders by Order ID. This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers). This issue has been patched in versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
spree · spreeReferencias
https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L14https://github.com/spree/spree/blob/1341623f2ae92685cdbe232885bf5808fc8f9ca8/storefront/app/controllers/spree/orders_controller.rb#L51C1-L55C8https://github.com/spree/spree/blob/a878eb4a782ce0445d218ea86fb12075b0e3d7cc/core/lib/spree/core/number_generator.rb#L45https://github.com/spree/spree/commit/3e00be64c128ef4bd4b99731f0c3ab469509cfabhttps://github.com/spree/spree/commit/6b32ed7d474aa55fa441990e6aa39740152aa1behttps://github.com/spree/spree/commit/6f6b8a7a28a8bff24a6e20eab04b4bbbdf39384dhttps://github.com/spree/spree/commit/ea4a5db590ca753dbc986f2a4e818d9e0edfb1adhttps://github.com/spree/spree/security/advisories/GHSA-p6pv-q7rc-g4h9