{"action":"Upgrade spree to 0.4.0 or later.","affected":[{"fixed":"0.4.0","introduced":"0"}],"component":"spree","cve_ids":["CVE-2008-7310"],"ecosystem":"RubyGems","epss":0.0123,"exploited":false,"fixed_versions":["0.4.0"],"ghsa_id":"GHSA-7h48-m3rw-vr27","id":"tcs_01M5KEHQTWP87KDBXVPT049FF4","modified_at":"2024-12-07T05:41:01.800352Z","published_at":"2022-05-17T05:31:08Z","references":["https://osv.dev/vulnerability/GHSA-7h48-m3rw-vr27","https://nvd.nist.gov/vuln/detail/CVE-2008-7310","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2008-7310.yml","https://github.com/spree/spree","https://spreecommerce.com/blog/security-vulnerability-mass-assignment","https://web.archive.org/web/20080925003904/http://railspikes.com/2008/9/22/is-your-rails-application-safe-from-mass-assignment","https://web.archive.org/web/20101128024717/http://spreecommerce.com/blog/2008/09/16/security-vulnerability-mass-assignment-of-order-params","http://railspikes.com/2008/9/22/is-your-rails-application-safe-from-mass-assignment","http://spreecommerce.com/blog/2008/09/16/security-vulnerability-mass-assignment-of-order-params"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-7h48-m3rw-vr27","url":"https://osv.dev/vulnerability/GHSA-7h48-m3rw-vr27"}],"summary":"Spree does not properly restrict the use of a hash to provide values for a model's attributes"}