CVE-2013-1656
Spree Improper Input Validation vulnerability
Description
Spree Commerce 1.0.x before 2.0.0.rc1 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) `payment_method` parameter to `core/app/controllers/spree/admin/payment_methods_controller.rb`; and the (2) `promotion_action parameter` to `promotion_actions_controller.rb`, (3) `promotion_rule parameter` to `promotion_rules_controller.rb`, and (4) `calculator_type` parameter to `promotions_controller.rb` in `promo/app/controllers/spree/admin/`, related to unsafe use of the constantize function.
How to fix CVE-2013-1656
To remediate CVE-2013-1656, upgrade the affected package to a fixed version below.
- —upgrade to 2.0.0.rc1 or later
Is CVE-2013-1656 being exploited?
Low — EPSS is 1.5%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 1.0.0, < 2.0.0.rc1