Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
CSV formula injection (also known as formula injection or CSV injection) affects customer export. User-controlled values customer names, email addresses, and shipping addresses. When an administrator opens a crafted Export in Microsoft Excel or LibreOffice Calc, formulas embedded in user data execute in the context of the administrator's desktop, potentially exfiltrating data or executing OS commands via DDE (Dynamic Data Exchange). --- Details Affected presenters and fields | Presenter | Path | User-controlled fields | |---|---|---| | CustomerPresenter | spree/core/app/presenters/spree/csv/customerpresenter.rb:36 | firstname, lastname, address1, address2, city, phone | Vulnerable code — customerpresenter.rb (representative example) --- PoC Precondition: A Spree store with public customer registration enabled (default configuration). No special permissions required for the attacker. Step 1 — Register as a customer with an injected first name Step 2 — Admin triggers a customer…
Recommended action: Upgrade to 5.4.3, 5.3.6 or 5.2.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.
Recommended action: Upgrade to 0.60.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability.
Recommended action: Upgrade to 0.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.actioncontrollersession hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the config/environment.rb file.
Recommended action: Upgrade to 0.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) admin/products.json, (2) admin/users.json, or (3) admin/overview/getreportdata, related to a "JSON hijacking" issue.
Recommended action: Upgrade to 0.30.0 or 0.11.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The perpetrator who previously obtained an old expired user token could use it to access Storefront API v2 endpoints. Patches Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Workarounds In your project directory create a decorator file app/controllers/spree/api/v2/basecontrollerdecotatror.rb with contents: For more information If you have any questions or comments about this advisory: Email us at security@spreecommerce.org
Recommended action: Upgrade to 4.1.11, 4.0.4 or 3.7.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Spree Commerce 1.0.x before 2.0.0.rc1 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) paymentmethod parameter to core/app/controllers/spree/admin/paymentmethodscontroller.rb; and the (2) promotionaction parameter to promotionactionscontroller.rb, (3) promotionrule parameter to promotionrulescontroller.rb, and (4) calculatortype parameter to promotionscontroller.rb in promo/app/controllers/spree/admin/, related to unsafe use of the constantize function.
Recommended action: Upgrade to 2.0.0.rc1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.