Description (CNA)
In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| spree / spree | affected < 3.7.11; affected >= 4.0.0, < 4.0.4; affected >= 4.1.0, < 4.1.11 |
CWE
CWE-287, CWE-613
References
- https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh
- https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847
ADP enrichment
No English description supplied.