Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) admin/products.json, (2) admin/users.json, or (3) admin/overview/get_report_data, related to a "JSON hijacking" issue.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2010-11-17T15:00:00

Updated: 2024-08-07T03:26:12.329Z

Reserved: 2010-10-18T00:00:00

Link: CVE-2010-3978

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2010-11-17T16:00:02.343

Modified: 2024-11-21T01:20:00.233

Link: CVE-2010-3978

cve-icon Redhat

No data.