CVE-2008-7310
Spree 0.2.0 - Unauthenticated Order State Manipulation via Mass Assignment
Title source: llmDescription
Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability.
References (2)
Core 2
Core References
Various Sources x_refsource_misc
http://railspikes.com/2008/9/22/is-your-rails-application-safe-from-mass-assignment
Vendor Advisory x_refsource_confirm
http://spreecommerce.com/blog/2008/09/16/security-vulnerability-mass-assignment-of-order-params/
Scores
EPSS
0.0016
EPSS Percentile
36.2%
Details
CWE
CWE-255
Status
published
Products (2)
rubygems/spree
0 - 0.4.0RubyGems
spreecommerce/spree
0.2.0
Published
Apr 05, 2012
Tracked Since
Feb 18, 2026