CVE-2008-7311
The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the config/environment.rb file.
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
- CWE
- CWE-255
- Published
- Modified
- Record from
- the NVD, synced
Affected
- spreecommerce:spree
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-g466-57gh-cqfw | RubyGems | spree | <0.4.0 | 0.4.0 |