« Volver al listado

CVE-2020-15269

Estado: ModificadaCrítica (9.1)—

In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Sparksolutions — Spree

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-15269",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.4,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "spree",
          "product": "spree",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.7.11"
            },
            {
              "status": "affected",
              "version": ">= 4.0.0, < 4.0.4"
            },
            {
              "status": "affected",
              "version": ">= 4.1.0, < 4.1.11"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-10-20T21:15:12.743",
  "references": [
    {
      "url": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        },
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory."
    },
    {
      "lang": "es",
      "value": "En Spree versiones anteriores a 3.7.11, 4.0.4 o 4.1.11, los tokens de usuario vencidos podrían ser usados para acceder a los endpoints de Storefront API versión v2.&#xa0;El problema está parcheado en las versiones 3.7.11, 4.0.4 y 4.1.11.&#xa0;Una solución alternativa sin actualizar es descrita en el aviso vinculado"
    }
  ],
  "lastModified": "2026-06-17T02:56:23.750",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sparksolutions:spree:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E26F2607-9260-4AA3-A636-3D5EB219CB3A",
              "versionEndExcluding": "3.7.11"
            },
            {
              "criteria": "cpe:2.3:a:sparksolutions:spree:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7B96C57-83B7-4975-A978-64488EC00415",
              "versionEndExcluding": "4.0.4",
              "versionStartIncluding": "4.0.0"
            },
            {
              "criteria": "cpe:2.3:a:sparksolutions:spree:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1636D8F5-D862-4F97-B6E8-28D1874A4826",
              "versionEndExcluding": "4.1.11",
              "versionStartIncluding": "4.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}