CVE-2020-15269 Expired token reuse in Spree
Attackers can reuse expired tokens to access Storefront API v2 endpoints, potentially reading or modifying data in Spree e-commerce applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15269?
CVE-2020-15269 is a high-severity authentication bypass vulnerability in spree, published on 20 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.
Which versions are affected by CVE-2020-15269?
6 open source packages ship an affected version, including spree. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
spree RubyGems | All versions | 3.7.11 |
spree RubyGems | All versions | 3.7.11 |
spree RubyGems | From 4.0.0 | 4.0.4 |
spree RubyGems | From 4.0.0 | 4.0.4 |
spree RubyGems | From 4.1.0 | 4.1.11 |
spree RubyGems | From 4.1.0 | 4.1.11 |
Products include Sparksolutions Spree.
How do I fix CVE-2020-15269?
Upgrade spree to a fixed version for your release line: 3.7.11, 4.0.4 or 4.1.11.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-15269 being exploited?
There is no known exploitation of CVE-2020-15269 in the wild and no public exploit code.
Sources
Also known as GHSA-f8cm-364f-q9qh.