CVE-2013-1656
Spree Improper Input Validation vulnerability
CVE-2013-1656 is a medium vulnerability (CVSS 4.3) in Spreecommerce Spree, published March 8, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.53%, the 75th percentile. Fixed in spree 2.0.0.rc1.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 1.53%EPSS, 75th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.0.0.rc1spree +1 more
Description
Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the (2) promotion_action parameter to promotion_actions_controller.rb, (3) promotion_rule parameter to promotion_rules_controller.rb, and (4) calculator_type parameter to promotions_controller.rb in promo/app/controllers/spree/admin/, related to unsafe use of the constantize function.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
spreeRubyGems | 1.0.0 up to 2.0.0.rc1 | 2.0.0.rc1 |
spreeRubyGems | 1.0.0 up to 2.0.0.rc1, plus listed versions 1.0.11.0.21.0.31.0.41.0.6 Show 26 moreShow less1.0.71.1.01.1.0.rc11.1.0.rc21.1.11.1.21.1.2.rc11.1.31.1.41.1.51.1.61.2.01.2.0.rc11.2.0.rc21.2.21.2.31.2.41.2.51.3.01.3.0.rc11.3.0.rc21.3.11.3.21.3.31.3.41.3.5 | 2.0.0.rc1 |
What each source reports
NVD Score used
Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the (2) promotion_action parameter to promotion_actions_controller.rb, (3) promotion_rule parameter to promotion_rules_controller.rb, and (4) calculator_type parameter to promotions_controller.rb in promo/app/controllers/spree/admin/, related to unsafe use of the constantize function.
- Record
CVE-2013-1656- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the (2) promotion_action parameter to promotion_actions_controller.rb, (3) promotion_rule parameter to promotion_rules_controller.rb, and (4) calculator_type parameter to promotions_controller.rb in promo/app/controllers/spree/admin/, related to unsafe use of the constantize function.
- Record
CVE-2013-1656- Updated
- 2026-11-02
EUVDEUVD-2017-0268No score
Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the (2) promotion_action parameter to promotion_actions_controller.rb, (3) promotion_rule parameter to promotion_rules_controller.rb, and (4) calculator_type parameter to promotions_controller.rb in promo/app/controllers/spree/admin/, related to unsafe use of the constantize function.
- Record
EUVD-2017-0268- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jxx8-v83v-rhw3No score
Spree Improper Input Validation vulnerability
Spree Commerce 1.0.x before 2.0.0.rc1 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the (2) promotion_action parameter to promotion_actions_controller.rb, (3) promotion_rule parameter to promotion_rules_controller.rb, and (4) calculator_type parameter to promotions_controller.rb in promo/app/controllers/spree/admin/, related to unsafe use of the constantize function.
- Record
GHSA-jxx8-v83v-rhw3- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-jxx8-v83v-rhw3No score
Spree Improper Input Validation vulnerability
Spree Commerce 1.0.x before 2.0.0.rc1 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the (2) promotion_action parameter to promotion_actions_controller.rb, (3) promotion_rule parameter to promotion_rules_controller.rb, and (4) calculator_type parameter to promotions_controller.rb in promo/app/controllers/spree/admin/, related to unsafe use of the constantize function.
- Record
GHSA-jxx8-v83v-rhw3- Weakness
- CWE-20
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
blog.conviso.com.br/2013/03/spree-commerce-multiple-unsafe.html
spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
conviso.com.br/advisories/CVE-2013-1656.txt
nvd.nist.gov/vuln/detail/CVE-2013-1656
web.archive.org/web/20130907044454/https://www.conviso.com.br/advisories/CVE-2013-1656.txt
Show 6 moreShow less
github.com/spree/spree/commit/70092eb55b8be8fe5d21a7658b62da658612fba7
blog.convisoappsec.com/en/spree-commerce-multiple-unsafe-reflection-vulnerabilities-cve-2013-1656