What’s Vulnerable › Vulnerabilities

CVE-2008-7311

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2012-04-05 · updated 2026-06-16
• Weakness: CWE-255

Description

The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the config/environment.rb file.

Affected products

• spree: 0.2.0

References

• http://spreecommerce.com/blog/2008/08/12/security-vulernability-session-cookie-store/
• http://support.spreehq.org/issues/show/63
• http://spreecommerce.com/blog/2008/08/12/security-vulernability-session-cookie-store/
• http://support.spreehq.org/issues/show/63

Get alerted when CVE-2008-7311 or the next vulnerability affects your stack