{"action":"Upgrade spree to 2.0.0.rc1 or later.","affected":[{"fixed":"2.0.0.rc1","introduced":"1.0.0"}],"component":"spree","cve_ids":["CVE-2013-1656"],"ecosystem":"RubyGems","epss":0.01531,"exploited":false,"fixed_versions":["2.0.0.rc1"],"ghsa_id":"GHSA-jxx8-v83v-rhw3","id":"tcs_01M5KEM30JS5GX9A1X7S2J9W1H","modified_at":"2024-12-05T05:39:10.762524Z","published_at":"2017-10-24T18:33:37Z","references":["https://osv.dev/vulnerability/GHSA-jxx8-v83v-rhw3","https://nvd.nist.gov/vuln/detail/CVE-2013-1656","https://github.com/spree/spree/commit/70092eb55b8be8fe5d21a7658b62da658612fba7","https://blog.convisoappsec.com/en/spree-commerce-multiple-unsafe-reflection-vulnerabilities-cve-2013-1656","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2013-1656.yml","https://github.com/spree/spree","https://web.archive.org/web/20130907044454/https://www.conviso.com.br/advisories/CVE-2013-1656.txt","https://web.archive.org/web/20140329142330/http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed","https://web.archive.org/web/20140618100330/http://blog.conviso.com.br/2013/03/spree-commerce-multiple-unsafe.html"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-jxx8-v83v-rhw3","url":"https://osv.dev/vulnerability/GHSA-jxx8-v83v-rhw3"}],"summary":"Spree Improper Input Validation vulnerability"}