CVE-2013-2506

app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:N/I:P/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 39%
VendorProductVersion
spreecommercespree
1.1.0
spreecommercespree
1.1.1
spreecommercespree
1.1.2
spreecommercespree
1.1.3
spreecommercespree
1.1.4
spreecommercespree
1.1.5
spreecommercespree
1.1.6
spreecommercespree
1.2.0
spreecommercespree
1.2.1
spreecommercespree
1.2.2
spreecommercespree
1.2.3
spreecommercespree
1.2.4
spreecommercespree
1.3.0
spreecommercespree
1.3.1
spreecommercespree
1.3.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
https://github.com/spree/spree_auth_devise/commit/038d74771d3b5c13d13b738b73dfda1033a99f65
http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
https://github.com/spree/spree_auth_devise/commit/038d74771d3b5c13d13b738b73dfda1033a99f65