CVE-2020-15269 — Expired token reuse in Spree
In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.…
Published: 2020-10-20 · CVSS: 7.4 · CVSS 3.1
In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7