CVE-2008-7311: Spreecommerce Spree

Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days.

The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the config/environment.rb file.

Affected products

• Spreecommerce Spree: version 0.2.0 only

Published 2012-04-05. Last modified 2026-06-16.