CVE-2008-7311 Spree uses a hardcoded hash value
Remote attackers can bypass session security in Spree by exploiting a hardcoded secret key, allowing them to forge valid session cookies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2008-7311?
CVE-2008-7311 is a medium-severity vulnerability in n/a, published on 4 Apr 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the config/environment.rb file.
Weakness: CWE-255
Which versions are affected by CVE-2008-7311?
2 open source packages ship an affected version, including spree. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
spree RubyGems | All versions | 0.4.0 |
spree RubyGems | All versions | 0.4.0 |
Products include Spreecommerce Spree.
How do I fix CVE-2008-7311?
Upgrade spree to 0.4.0 or later.
Is CVE-2008-7311 being exploited?
There is no known exploitation of CVE-2008-7311 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2011-10019 Spreecommerce < 0.60.2 Search Parameter RCE
- CVE-2011-10026 Spreecommerce < 0.50.x API RCE
- CVE-2026-25757 Unauthenticated Spree Commerce users can view completed guest orders by Order ID
- CVE-2026-25758 Spree allows unauthenticated users can access all guest addresses
- CVE-2020-26223 Authorization bypass in Spree
Sources
Also known as GHSA-g466-57gh-cqfw.