CVE-2008-7310

Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value…

published April 4, 2012

CVSS
—
EPSS
1%
Percentile
68.5
In the wild
Unconfirmed
What it is

Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01230 · 68.5th percentile
Published
2012-04-04T22:00Z
EPSS history
Timeline
  • 04 APR 22:00Z
    Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value…
    cvelistv5