Spree JSON Information Disclosure Vulnerability

Bugtraq ID:	44721
Class:	Unknown
CVE:	CVE-2010-3978
Remote:	Yes
Local:	No
Published:	Nov 08 2010 12:00AM
Updated:	Nov 08 2010 12:00AM
Credit:	Gabriel Quadros and Rodrigo Rubira Branco.
Vulnerable:
Not Vulnerable:

Spree JSON Information Disclosure Vulnerability

Spree is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to obtain potentially sensitive information that may lead to further attacks.

Versions prior to Spree 0.11.2 are vulnerable.

Spree JSON Information Disclosure Vulnerability

An attacker entices a user to visit a malicious website.

A working proof-of-concept is reported to be available with Check Point Software Technologies - Vulnerability Discovery Team.

Spree JSON Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.

Spree JSON Information Disclosure Vulnerability

References:

• JSON Hijacking Vulnerability (Spree)
  
• Spree Homepage (Spree)
  
• Spree e-commerce JSON Hijacking Vulnerabilities - CVE-2010-3978 (Rodrigo Branco )