RubyGems/devise CVE-2013-0233: medium, EPSS 14.13%
Devise does not properly perform type conversion when performing database queries
Action: Upgrade devise to 1.5.4 or later.
bundle update deviseAffected
| introduced | fixed | last affected |
|---|---|---|
| 2.2.0 | 2.2.3 | - |
| 2.1.0 | 2.1.3 | - |
| 2.0.0 | 2.0.5 | - |
| 1.5.0 | 1.5.4 | - |
Fixed versions
| 2.2.3 | 2.1.3 | 2.0.5 | 1.5.4 |
Sources
- osv: GHSA-jxhw-mg8m-2pj8
- https://nvd.nist.gov/vuln/detail/CVE-2013-0233
- https://github.com/Snorby/snorby/issues/261
- https://web.archive.org/web/20140726005251/http://www.phenoelit.org/blog/archives/2013/02/05/mysql_madness_and_rails/index.html
- https://web.archive.org/web/20200229103406/http://www.securityfocus.com/bid/57577
- http://blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released
- http://lists.opensuse.org/opensuse-updates/2013-03/msg00000.html
- http://www.metasploit.com/modules/auxiliary/admin/http/rails_devise_pass_reset
- http://www.openwall.com/lists/oss-security/2013/01/29/3
CVE-2013-0233 · published · modified · JSON