CVE-2013-0233
25.04.2013, 23:55
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.Enginsight
| Vendor | Product | Version |
|---|---|---|
| plataformatec | devise | 1.5.0 |
| plataformatec | devise | 1.5.1 |
| plataformatec | devise | 1.5.2 |
| plataformatec | devise | 1.5.3 |
| plataformatec | devise | 2.0.0 |
| plataformatec | devise | 2.0.1 |
| plataformatec | devise | 2.0.2 |
| plataformatec | devise | 2.0.3 |
| plataformatec | devise | 2.0.4 |
| plataformatec | devise | 2.1.0 |
| plataformatec | devise | 2.1.1 |
| plataformatec | devise | 2.1.2 |
| plataformatec | devise | 2.2.0 |
| plataformatec | devise | 2.2.1 |
| plataformatec | devise | 2.2.2 |
| opensuse | opensuse | 12.2 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
References