CVE-2010-3978 Spree allows remote attackers to obtain sensitive information

What is CVE-2010-3978?

CVE-2010-3978 is a medium-severity vulnerability in n/a, published on 17 Nov 2010. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) admin/products.json, (2) admin/users.json, or (3) admin/overview/get_report_data, related to a "JSON hijacking" issue.

Weakness: CWE-200

Which versions are affected by CVE-2010-3978?

4 open source packages ship an affected version, including spree. It affects 1 product.

Products include Spreecommerce Spree.

How do I fix CVE-2010-3978?

Upgrade spree to a fixed version for your release line: 0.11.2 or 0.30.0.

Is CVE-2010-3978 being exploited?

There is no known exploitation of CVE-2010-3978 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2011-10019 Spreecommerce < 0.60.2 Search Parameter RCE Critical 10.0
• CVE-2011-10026 Spreecommerce < 0.50.x API RCE Critical 9.3
• CVE-2026-25757 Unauthenticated Spree Commerce users can view completed guest orders by Order ID High 7.7
• CVE-2026-25758 Spree allows unauthenticated users can access all guest addresses High 7.7
• CVE-2020-26223 Authorization bypass in Spree High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hwrx-wc75-mgh7.