CVE-2013-0233

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.

Affected Software

Name	Vendor	Start Version	End Version
Devise	Plataformatec	1.5.0 (including)	1.5.0 (including)
Devise	Plataformatec	1.5.1 (including)	1.5.1 (including)
Devise	Plataformatec	1.5.2 (including)	1.5.2 (including)
Devise	Plataformatec	1.5.3 (including)	1.5.3 (including)
Devise	Plataformatec	2.0.0 (including)	2.0.0 (including)
Devise	Plataformatec	2.0.1 (including)	2.0.1 (including)
Devise	Plataformatec	2.0.2 (including)	2.0.2 (including)
Devise	Plataformatec	2.0.3 (including)	2.0.3 (including)
Devise	Plataformatec	2.0.4 (including)	2.0.4 (including)
Devise	Plataformatec	2.1.0 (including)	2.1.0 (including)
Devise	Plataformatec	2.1.1 (including)	2.1.1 (including)
Devise	Plataformatec	2.1.2 (including)	2.1.2 (including)
Devise	Plataformatec	2.2.0 (including)	2.2.0 (including)
Devise	Plataformatec	2.2.1 (including)	2.2.1 (including)
Devise	Plataformatec	2.2.2 (including)	2.2.2 (including)
Ruby-devise	Ubuntu	trusty	*
Ruby-devise	Ubuntu	upstream	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2013-0233
CWE	https://cwe.mitre.org/data/definitions/399.html

Affected Software

References