CVE

Id
46562  
CVE No.
CVE-2010-3978  
Status
Candidate  
Description
Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) admin/products.json, (2) admin/users.json, or (3) admin/overview/get_report_data, related to a "JSON hijacking" issue.  
Phase
Assigned (20101018)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
508586 46562 CVE-2010-3978 BUGTRAQ:20101108 Spree e-commerce JSON Hijacking Vulnerabilities - CVE-2010-3978  View
508587 46562 CVE-2010-3978 URL:http://www.securityfocus.com/archive/1/archive/1/514674/100/0/threaded  View
508588 46562 CVE-2010-3978 MISC:http://twitter.com/conviso/statuses/29555076248  View
508589 46562 CVE-2010-3978 MISC:http://www.conviso.com.br/json-hijacking-vulnerability/  View
508590 46562 CVE-2010-3978 MISC:http://www.conviso.com.br/security-advisory-spree-e-commerce-json-v-0-11x/  View
508591 46562 CVE-2010-3978 CONFIRM:http://spreecommerce.com/blog/2010/11/02/json-hijacking-vulnerability/  View
508592 46562 CVE-2010-3978 CONFIRM:http://spreecommerce.com/blog/2010/11/09/spree-0-30-0-released/  View
508593 46562 CVE-2010-3978 CONFIRM:https://github.com/railsdog/spree/commit/19944bd999c310d9b10d16a41f48ebac97dc4fac  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
37496 JVNDB-2010-003281 SAP BusinessObjects Enterprise における任意のポートおよびイントラネットホストへの TCP 接続を誘発する脆弱性 SAP BusinessObjects Enterprise には、任意のポートおよびイントラネットホストへの TCP 接続を誘発する、およびオープンポートに関する重要な情報を取得される脆弱性が存在します。 CVE-2010-3982 46562 5 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-003281.html  View