GHSA-jxhw-mg8m-2pj8 CVE-2013-0233
Devise does not properly perform type conversion when performing database queries
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- 14.13%
- Chance of exploitation in the next 30 days. Higher than 96.57% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-704 Incorrect Type Conversion or Cast
- Fix
2.2.3- Upgrade devise to this version or later
Description
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| devise | >= 2.2.0, < 2.2.3 |
2.2.3 |
| devise | >= 2.1.0, < 2.1.3 |
2.1.3 |
| devise | >= 2.0.0, < 2.0.5 |
2.0.5 |
| devise | >= 1.5.0, < 1.5.4 |
1.5.4 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
devise RubyGems → 2.2.3
- bundler
bundle update devise # Gemfile: gem "devise", ">= 2.2.3"
Weakness
CWE-704: Incorrect Type Conversion or Cast
The product does not correctly convert an object, resource, or structure from one type to a different type.
References
Advisories
Other links
- github.com/Snorby/snorby/issues/261
- web.archive.org/web/20140726005251/http://www.phenoelit.org/blog/archives/2013/02/05…
- web.archive.org/web/20200229103406/http://www.securityfocus.com/bid/57577
- blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3…
- lists.opensuse.org/opensuse-updates/2013-03/msg00000.html
- metasploit.com/modules/auxiliary/admin/http/rails_devise_pass_reset
- openwall.com/lists/oss-security/2013/01/29/3
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-jp94-3292-c3xv Devise has an Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler | Medium | Also affects devise |
| GHSA-57hq-95w6-v4fc Devise has a confirmable "change email" race condition permits user to confirm email they have no access to | Medium | Also affects devise |
| GHSA-746g-3gfp-hfhw Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie | High | Also affects devise |
| GHSA-fcjw-8rhj-gwwc Authentication Bypass in Devise | Medium | Also affects devise |
| GHSA-73rf-6mrf-759q devise Time-of-check Time-of-use Race Condition vulnerability | Medium | Also affects devise |
| GHSA-6pq8-jhm2-2vcw qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS) | Medium | Same weakness, CWE-704 |
| EEF-CVE-2026-104634 beam_mcp: JSON boolean and null tool arguments reach dispatch as strings | Not rated yet | Same weakness, CWE-704 |
| GHSA-ph72-cqr5-qpp7 vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features | Medium | Same weakness, CWE-704 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor