CVE-2013-2506

app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:N/I:P/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 39%
VendorProductVersion
spreecommercespree
1.1.0
spreecommercespree
1.1.1
spreecommercespree
1.1.2
spreecommercespree
1.1.3
spreecommercespree
1.1.4
spreecommercespree
1.1.5
spreecommercespree
1.1.6
spreecommercespree
1.2.0
spreecommercespree
1.2.1
spreecommercespree
1.2.2
spreecommercespree
1.2.3
spreecommercespree
1.2.4
spreecommercespree
1.3.0
spreecommercespree
1.3.1
spreecommercespree
1.3.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration