CVE-2013-0233 Devise does not properly perform type conversion when performing database queries
MediumCVSS 6.8
EPSS 14.6%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems devise(RubyGems) | >= 2.2.0, < 2.2.3 | 2.2.3 |
| rubygems devise(RubyGems) | >= 2.1.0, < 2.1.3 | 2.1.3 |
| rubygems devise(RubyGems) | >= 2.0.0, < 2.0.5 | 2.0.5 |
| rubygems devise(RubyGems) | >= 1.5.0, < 1.5.4 | 1.5.4 |
| rubygems devise(RubyGems) | = 2.2.0 | No fix listed |
| rubygems devise(RubyGems) | = 2.2.1 | No fix listed |
| rubygems devise(RubyGems) | = 2.2.2 | No fix listed |
| rubygems devise(RubyGems) | = 2.1.0 | No fix listed |
| rubygems devise(RubyGems) | = 2.1.2 | No fix listed |
| rubygems devise(RubyGems) | = 2.0.0 | No fix listed |
| rubygems devise(RubyGems) | = 2.0.1 | No fix listed |
| rubygems devise(RubyGems) | = 2.0.2 | No fix listed |
| rubygems devise(RubyGems) | = 2.0.4 | No fix listed |
| rubygems devise(RubyGems) | = 1.5.0 | No fix listed |
| rubygems devise(RubyGems) | = 1.5.1 | No fix listed |
| rubygems devise(RubyGems) | = 1.5.2 | No fix listed |
| rubygems devise(RubyGems) | = 1.5.3 | No fix listed |
| debian/ruby-devise(Debian:12) | < 3.4.1-1 | 3.4.1-1 |
| plataformatec devise | = 1.5.0 | No fix listed |
| plataformatec devise | = 1.5.1 | No fix listed |
| plataformatec devise | = 1.5.2 | No fix listed |
| plataformatec devise | = 1.5.3 | No fix listed |
| plataformatec devise | = 2.0.0 | No fix listed |
| plataformatec devise | = 2.0.1 | No fix listed |
| plataformatec devise | = 2.0.2 | No fix listed |
Show 9 more
| Product | Affected versions | Fixed in |
|---|---|---|
| plataformatec devise | = 2.0.3 | No fix listed |
| plataformatec devise | = 2.0.4 | No fix listed |
| plataformatec devise | = 2.1.0 | No fix listed |
| plataformatec devise | = 2.1.1 | No fix listed |
| plataformatec devise | = 2.1.2 | No fix listed |
| plataformatec devise | = 2.2.0 | No fix listed |
| plataformatec devise | = 2.2.1 | No fix listed |
| plataformatec devise | = 2.2.2 | No fix listed |
| opensuse | = 12.2 | No fix listed |
References
- Debian Security Tracker CVE-2013-0233 vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- blog.plataformatec.com.br vendor-advisory
- openSUSE-SU-2013:0374 vendor-advisory
- www.metasploit.com exploit
- [oss-security] 20130128 Re: CVE request for 'devise' ruby gem mailing-list
- web.archive.org
- web.archive.org
- github.com
- www.phenoelit.org exploit
- 57577 vdb-entry