UNKNOWN RubyGems
Spree uses a hardcoded hash value
GHSA-g466-57gh-cqfw · CVE-2008-7311
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the config/environment.rb file.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2008-7311
- WEB https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2008-7311.yml
- PACKAGE https://github.com/spree/spree
- WEB https://spreecommerce.com/blog/security-vulernability-session-cookie-store
- WEB https://web.archive.org/web/20090306033106/http://support.spreehq.org/issues/show/63
- WEB https://web.archive.org/web/20100309050152/http://rubygems.org/gems/spree/versions
- WEB https://web.archive.org/web/20101128024939/http://spreecommerce.com/blog/2008/08/12/security-vulernability-session-cookie-store
- WEB http://spreecommerce.com/blog/2008/08/12/security-vulernability-session-cookie-store
Ready to move
Start Securing
Free, no credit card | First findings in minutes