{"id":"CVE-2008-7310","aliases":["EUVD-2022-3007","GHSA-7h48-m3rw-vr27"],"status":"published","title":"Spree does not properly restrict the use of a hash to provide values for a model's attributes","description":"Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a \"mass assignment\" vulnerability.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0123,"percentile":0.69133,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-255"],"published":"2012-04-04T22:00:00Z","modified":"2026-06-16T23:04:01Z","fixes":[{"ecosystem":"RubyGems","package":"spree","fixed_in":["0.4.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"spree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"spree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}],"versions":["0.0.5","0.0.6","0.0.7","0.0.8","0.0.9","0.2.0"]}],"products":[{"vendor":"spreecommerce","product":"spree"}],"references":[{"url":"http://spreecommerce.com/blog/2008/09/16/security-vulnerability-mass-assignment-of-order-params/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://railspikes.com/2008/9/22/is-your-rails-application-safe-from-mass-assignment","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-7310","tags":["advisory"]},{"url":"https://web.archive.org/web/20080925003904/http://railspikes.com/2008/9/22/is-your-rails-application-safe-from-mass-assignment","tags":["web"]},{"url":"https://web.archive.org/web/20101128024717/http://spreecommerce.com/blog/2008/09/16/security-vulnerability-mass-assignment-of-order-params/"},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2008-7310.yml","tags":["web"]},{"url":"https://spreecommerce.com/blog/security-vulnerability-mass-assignment","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7h48-m3rw-vr27"},{"url":"https://github.com/spree/spree","tags":["package"]},{"url":"https://web.archive.org/web/20101128024717/http://spreecommerce.com/blog/2008/09/16/security-vulnerability-mass-assignment-of-order-params","tags":["web"]},{"url":"http://spreecommerce.com/blog/2008/09/16/security-vulnerability-mass-assignment-of-order-params","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2008-7310","description":"Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a \"mass assignment\" vulnerability.","status":"published","published":"2012-04-04T22:00:00Z","modified":"2024-09-16T23:30:34.534Z","updated_at":"2026-11-02T14:34:48.505097Z"}],"euvd":[{"id":"EUVD-2022-3007","description":"Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a \"mass assignment\" vulnerability.","status":"published","published":"2012-04-04T22:00:00Z","modified":"2024-09-16T23:30:34Z","updated_at":"2026-11-03T00:54:49.761845Z"}],"ghsa":[{"id":"GHSA-7h48-m3rw-vr27","title":"Spree does not properly restrict the use of a hash to provide values for a model's attributes","description":"Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a \"mass assignment\" vulnerability.","status":"published","published":"2022-05-17T05:31:08Z","modified":"2023-08-23T16:38:49Z","updated_at":"2026-11-02T14:37:00.680009Z"}],"nvd":[{"id":"CVE-2008-7310","description":"Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a \"mass assignment\" vulnerability.","status":"published","published":"2012-04-05T13:25:21.177Z","modified":"2026-06-16T23:04:01.99Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-255"],"updated_at":"2026-11-02T14:01:32.353533Z"}],"osv":[{"id":"GHSA-7h48-m3rw-vr27","title":"Spree does not properly restrict the use of a hash to provide values for a model's attributes","description":"Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a \"mass assignment\" vulnerability.","status":"published","published":"2022-05-17T05:31:08Z","modified":"2024-12-07T05:41:01.800352Z","updated_at":"2026-11-02T15:46:41.002603Z"}]}}