{"action":"Upgrade spree to 0.4.0 or later.","affected":[{"fixed":"0.4.0","introduced":"0"}],"component":"spree","cve_ids":["CVE-2008-7311"],"ecosystem":"RubyGems","epss":0.0123,"exploited":false,"fixed_versions":["0.4.0"],"ghsa_id":"GHSA-g466-57gh-cqfw","id":"tcs_01M5KEK7KFNC78W30HJ2YFSN2F","modified_at":"2024-12-07T05:40:51.888750Z","published_at":"2022-05-17T05:30:58Z","references":["https://osv.dev/vulnerability/GHSA-g466-57gh-cqfw","https://nvd.nist.gov/vuln/detail/CVE-2008-7311","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2008-7311.yml","https://github.com/spree/spree","https://spreecommerce.com/blog/security-vulernability-session-cookie-store","https://web.archive.org/web/20090306033106/http://support.spreehq.org/issues/show/63","https://web.archive.org/web/20100309050152/http://rubygems.org/gems/spree/versions","https://web.archive.org/web/20101128024939/http://spreecommerce.com/blog/2008/08/12/security-vulernability-session-cookie-store","http://spreecommerce.com/blog/2008/08/12/security-vulernability-session-cookie-store"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-g466-57gh-cqfw","url":"https://osv.dev/vulnerability/GHSA-g466-57gh-cqfw"}],"summary":"Spree uses a hardcoded hash value"}