CVE-2013-0233: Incorrect Type Cast
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0233?
CVE-2013-0233 is considered a moderate severity vulnerability due to its potential to cause incorrect query results and bypass security checks.
How do I fix CVE-2013-0233?
To fix CVE-2013-0233, update the Devise gem to version 1.5.4, 2.0.5, 2.1.3, or 2.2.3.
What systems are affected by CVE-2013-0233?
CVE-2013-0233 affects Devise versions prior to 2.2.3, 2.1.3, 2.0.5, and 1.5.4, particularly when using certain databases.
Is my installation vulnerable if I use Devise version 2.2.3 or later?
If you are using Devise version 2.2.3 or later, your installation is not vulnerable to CVE-2013-0233.
What can attackers exploit in CVE-2013-0233?
Attackers can exploit CVE-2013-0233 to manipulate database queries, causing incorrect results and potentially bypassing authentication checks.