{"action":"Upgrade devise to 1.5.4 or later.","affected":[{"fixed":"2.2.3","introduced":"2.2.0"},{"fixed":"2.1.3","introduced":"2.1.0"},{"fixed":"2.0.5","introduced":"2.0.0"},{"fixed":"1.5.4","introduced":"1.5.0"}],"component":"devise","cve_ids":["CVE-2013-0233"],"ecosystem":"RubyGems","epss":0.14126,"exploited":false,"fixed_versions":["2.2.3","2.1.3","2.0.5","1.5.4"],"ghsa_id":"GHSA-jxhw-mg8m-2pj8","id":"tcs_01M5KEM2PR42YN1REJBM6A07FC","modified_at":"2024-12-03T06:09:05.521253Z","published_at":"2017-10-24T18:33:37Z","references":["https://osv.dev/vulnerability/GHSA-jxhw-mg8m-2pj8","https://nvd.nist.gov/vuln/detail/CVE-2013-0233","https://github.com/Snorby/snorby/issues/261","https://web.archive.org/web/20140726005251/http://www.phenoelit.org/blog/archives/2013/02/05/mysql_madness_and_rails/index.html","https://web.archive.org/web/20200229103406/http://www.securityfocus.com/bid/57577","http://blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released","http://lists.opensuse.org/opensuse-updates/2013-03/msg00000.html","http://www.metasploit.com/modules/auxiliary/admin/http/rails_devise_pass_reset","http://www.openwall.com/lists/oss-security/2013/01/29/3"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-jxhw-mg8m-2pj8","url":"https://osv.dev/vulnerability/GHSA-jxhw-mg8m-2pj8"}],"summary":"Devise does not properly perform type conversion when performing database queries"}