You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Spree Improper Input Validation vulnerability
Moderate severity
GitHub Reviewed
Published
Oct 24, 2017
to the GitHub Advisory Database
•
Updated Nov 5, 2023
Spree Commerce 1.0.x before 2.0.0.rc1 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the (2) promotion_action parameter to promotion_actions_controller.rb, (3) promotion_rule parameter to promotion_rules_controller.rb, and (4) calculator_type parameter to promotions_controller.rb in promo/app/controllers/spree/admin/, related to unsafe use of the constantize function.
Spree Commerce 1.0.x before 2.0.0.rc1 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1)
payment_method
parameter tocore/app/controllers/spree/admin/payment_methods_controller.rb
; and the (2)promotion_action parameter
topromotion_actions_controller.rb
, (3)promotion_rule parameter
topromotion_rules_controller.rb
, and (4)calculator_type
parameter topromotions_controller.rb
inpromo/app/controllers/spree/admin/
, related to unsafe use of the constantize function.References