GHSA-jp57-9j37-5476 CVE-2013-2506
spree_auth_devise allows remote authenticated users to assign themselves arbitrary roles
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- 1.26%
- Chance of exploitation in the next 30 days. Higher than 69.72% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
3.0.5- Upgrade spree_auth_devise to this version or later
Description
app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| spree_auth_devise | >= 1.0.0, < 3.0.5 |
3.0.5 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
spree_auth_devise RubyGems → 3.0.5
- bundler
bundle update spree_auth_devise # Gemfile: gem "spree_auth_devise", ">= 3.0.5"
References
Advisories
Packages
Other links
- github.com/spree/spree_auth_devise/commit/038d74771d3b5c13d13b738b73dfda1033a99f65
- github.com/spree/spree_auth_devise/commit/fda3ab9fb536c64fe18a9b78bb21c6176b3ea24d
- github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_auth/CVE-2013-2506.yml
- github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_auth_devise/CVE-2013…
- web.archive.org/web/20131207040639/https://rubygems.org/gems/spree_auth_devise/versions
- web.archive.org/web/20160331131233/https://spreecommerce.com/blog/multiple-security-…
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-26xx-m4q2-xhq8 Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness | Critical | Also affects spree_auth_devise |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor