CVE-2013-0233

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.

Published: Apr 26, 2013
Updated: May 9, 2024
CVE: CVE-2013-0233
GHSA: GHSA-jxhw-mg8m-2pj8
Severity: Medium
Exploit:

CVSS v2:

Severity: Medium
Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

CWE-399

Affected Software
References

Software	From	Fixed in
plataformatec / devise	1.5.0	1.5.0.x
plataformatec / devise	1.5.1	1.5.1.x
plataformatec / devise	1.5.2	1.5.2.x
plataformatec / devise	1.5.3	1.5.3.x
plataformatec / devise	2.0.0	2.0.0.x
plataformatec / devise	2.0.1	2.0.1.x
plataformatec / devise	2.0.2	2.0.2.x
plataformatec / devise	2.0.3	2.0.3.x
plataformatec / devise	2.0.4	2.0.4.x
plataformatec / devise	2.1.0	2.1.0.x
plataformatec / devise	2.1.1	2.1.1.x
plataformatec / devise	2.1.2	2.1.2.x
plataformatec / devise	2.2.0	2.2.0.x
plataformatec / devise	2.2.1	2.2.1.x
plataformatec / devise	2.2.2	2.2.2.x
opensuse / opensuse	12.2	12.2.x
devise	2.2.0	2.2.3
devise	2.1.0	2.1.3
devise	2.0.0	2.0.5
devise	1.5.0	1.5.4

Vulnerability Database

290,206

CVE-2013-0233