spree_auth_devise (RubyGems)
Advisories
8
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 4.4.1 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update spree_auth_devise # Gemfile: gem "spree_auth_devise", ">= 4.4.1"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-jp57-9j37-5476 spree_auth_devise allows remote authenticated users to assign themselves arbitrary roles |
Medium EPSS 1.26% |
>= 1.0.0, < 3.0.5 | 3.0.5 |
| GHSA-gpqc-4pp7-5954 Duplicate Advisory: Authentication Bypass by CSRF Weakness Withdrawn |
Critical | < 4.0.1 | 4.0.1 |
| GHSA-8xfw-5q82-3652 Duplicate Advisory: Authentication Bypass by CSRF Weakness Withdrawn |
Critical | >= 4.1.0, < 4.1.1 | 4.1.1 |
| GHSA-6mqr-q86q-6gwr Duplicate Advisory: Authentication Bypass by CSRF Weakness Withdrawn |
Critical | >= 4.2.0, < 4.2.1 | 4.2.1 |
| GHSA-26xx-m4q2-xhq8 Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness |
Critical EPSS 0.65% |
< 4.0.1 | 4.0.1 |
| GHSA-26xx-m4q2-xhq8 Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness |
Critical EPSS 0.65% |
>= 4.1.0, < 4.1.1 | 4.1.1 |
| GHSA-26xx-m4q2-xhq8 Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness |
Critical EPSS 0.65% |
>= 4.2.0, < 4.2.1 | 4.2.1 |
| GHSA-26xx-m4q2-xhq8 Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness |
Critical EPSS 0.65% |
>= 4.3.0, < 4.4.1 | 4.4.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor