CVE-2008-7311
Spree uses a hardcoded hash value
CVE-2008-7311 is a medium vulnerability (CVSS 5.0) in Spreecommerce Spree, published April 4, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.23%, the 68th percentile. Fixed in spree 0.4.0.
The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the config/environment.rb file.
Exploit likelihood
What each source reports
NVD Score used
The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the config/environment.rb file.
- Record
CVE-2008-7311- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-255
- Updated
- 2026-11-02
CVE List No score
The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the config/environment.rb file.
- Record
CVE-2008-7311- Updated
- 2026-11-02
EUVDEUVD-2022-3880 No score
The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the config/environment.rb file.
- Record
EUVD-2022-3880- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g466-57gh-cqfw No score
Spree uses a hardcoded hash value
The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the config/environment.rb file.
- Record
GHSA-g466-57gh-cqfw- Updated
- 2026-11-02
OSVGHSA-g466-57gh-cqfw No score
Spree uses a hardcoded hash value
The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the config/environment.rb file.
- Record
GHSA-g466-57gh-cqfw- Updated
- 2026-11-02
Affected products
Affected packages
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
support.spreehq.org/issues/show/63
spreecommerce.com/blog/2008/08/12/security-vulernability-session-cookie-store
nvd.nist.gov/vuln/detail/CVE-2008-7311
web.archive.org/web/20090306033106/http://support.spreehq.org/issues/show/63