CVE-2013-0233
Devise does not properly perform type conversion when performing database queries
EPSS 14.1%
Description
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
How to fix CVE-2013-0233
To remediate CVE-2013-0233, upgrade the affected package to a fixed version below.
- Debian/ruby-devise—upgrade to 3.4.1-1 or later
- —upgrade to 2.2.3 or later
Is CVE-2013-0233 being exploited?
Moderate — EPSS is 14.1%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (2)
- from 0, < 3.4.1-1
- >= 2.2.0, < 2.2.3