CVE-2013-0233

medium · 6.8

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.

6.8

CVSS

14.1%

EPSS (exploit prob.)

96th

EPSS percentile

2013-04-25

Published

AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

CWE-399

Affected products

Vendor	Product	Affected versions
plataformatec	devise	1.5.0
plataformatec	devise	1.5.1
plataformatec	devise	1.5.2
plataformatec	devise	1.5.3
plataformatec	devise	2.0.0
plataformatec	devise	2.0.1
plataformatec	devise	2.0.2
plataformatec	devise	2.0.3
plataformatec	devise	2.0.4
plataformatec	devise	2.1.0
plataformatec	devise	2.1.1
plataformatec	devise	2.1.2
plataformatec	devise	2.2.0
plataformatec	devise	2.2.1
plataformatec	devise	2.2.2
ruby-lang	ruby	all versions
opensuse	opensuse	12.2

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2013-0233