Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-y37s-b27m-n7ad
Vulnerability ID VCID-y37s-b27m-n7ad
Aliases CVE-2013-1656
GHSA-jxx8-v83v-rhw3
Summary Authenticated administrators to execute arbitrary commands Spree Commerce allow remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the (2) promotion_action parameter to promotion_actions_controller.rb, (3) promotion_rule parameter to promotion_rules_controller.rb, and (4) calculator_type parameter to promotions_controller.rb in promo/app/controllers/spree/admin/, related to unsafe use of the constantize function.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-20 Improper Input Validation
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00305 https://api.first.org/data/v1/epss?cve=CVE-2013-1656
epss 0.00305 https://api.first.org/data/v1/epss?cve=CVE-2013-1656
generic_textual MODERATE https://blog.convisoappsec.com/en/spree-commerce-multiple-unsafe-reflection-vulnerabilities-cve-2013-1656
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-jxx8-v83v-rhw3
generic_textual MODERATE https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2013-1656.yml
generic_textual MODERATE https://github.com/spree/spree
generic_textual MODERATE https://github.com/spree/spree/commit/70092eb55b8be8fe5d21a7658b62da658612fba7
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2013-1656
generic_textual MODERATE https://web.archive.org/web/20130907044454/https://www.conviso.com.br/advisories/CVE-2013-1656.txt
generic_textual MODERATE https://web.archive.org/web/20140329142330/http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
generic_textual MODERATE https://web.archive.org/web/20140618100330/http://blog.conviso.com.br/2013/03/spree-commerce-multiple-unsafe.html
Reference id Reference type URL
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1656
https://api.first.org/data/v1/epss?cve=CVE-2013-1656
https://blog.convisoappsec.com/en/spree-commerce-multiple-unsafe-reflection-vulnerabilities-cve-2013-1656
https://github.com/advisories/GHSA-jxx8-v83v-rhw3
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2013-1656.yml
https://github.com/spree/spree
https://github.com/spree/spree/commit/70092eb55b8be8fe5d21a7658b62da658612fba7
https://nvd.nist.gov/vuln/detail/CVE-2013-1656
https://web.archive.org/web/20130907044454/https://www.conviso.com.br/advisories/CVE-2013-1656.txt
https://web.archive.org/web/20140329142330/http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
https://web.archive.org/web/20140618100330/http://blog.conviso.com.br/2013/03/spree-commerce-multiple-unsafe.html
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.54043
EPSS Score 0.00305
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:36:08.003172+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/spree/CVE-2013-1656.yml 38.6.0