CVE-2013-0233
CVE-2013-0233
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
EPSS 14.1% · Public exploit · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
ruby-devise Debian:12
- Affected ranges
- ECOSYSTEM: < 3.4.1-1
Update to 3.4.1-1
Original sources
- http://www.metasploit.com/modules/auxiliary/admin/http/rails_devise_pass_reset
- http://www.openwall.com/lists/oss-security/2013/01/29/3
- http://www.phenoelit.org/blog/archives/2013/02/05/mysql_madness_and_rails/index.html
- http://lists.opensuse.org/opensuse-updates/2013-03/msg00000.html
- http://www.securityfocus.com/bid/57577
- http://blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released/
- https://github.com/Snorby/snorby/issues/261
- https://nvd.nist.gov/vuln/detail/CVE-2013-0233