CVE

Id
60180  
CVE No.
CVE-2013-0233  
Status
Candidate  
Description
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.  
Phase
Assigned (20121206)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
607423 60180 CVE-2013-0233 MLIST:[oss-security] 20130128 Re: CVE request for "devise" ruby gem  View
607424 60180 CVE-2013-0233 URL:http://www.openwall.com/lists/oss-security/2013/01/29/3  View
607425 60180 CVE-2013-0233 MISC:http://www.metasploit.com/modules/auxiliary/admin/http/rails_devise_pass_reset  View
607426 60180 CVE-2013-0233 MISC:http://www.phenoelit.org/blog/archives/2013/02/05/mysql_madness_and_rails/index.html  View
607427 60180 CVE-2013-0233 MISC:https://github.com/Snorby/snorby/issues/261  View
607428 60180 CVE-2013-0233 CONFIRM:http://blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released/  View
607429 60180 CVE-2013-0233 SUSE:openSUSE-SU-2013:0374  View
607430 60180 CVE-2013-0233 URL:http://lists.opensuse.org/opensuse-updates/2013-03/msg00000.html  View
607431 60180 CVE-2013-0233 BID:57577  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
19974 JVNDB-2013-001549 IRCD-Hybrid におけるサービス運用妨害 (クラッシュ) の脆弱性 IRCD-Hybrid の hostmask.c の try_parse_v4_netmask 関数は、マスクを適切に検証しないため、サービス運用妨害 (クラッシュ) 状態となる脆弱性が存在します。 CVE-2013-0238 60180 5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-001549.html  View