|
| 1 | +--- |
| 2 | +gem: spree_auth_devise |
| 3 | +cve: 2013-2506 |
| 4 | +osvdb: 90865 |
| 5 | +ghsa: jp57-9j37-5476 |
| 6 | +url: https://nvd.nist.gov/vuln/detail/CVE-2013-2506 |
| 7 | +title: Spree app/models/spree/user.rb |
| 8 | + Mass Role Assignment Remote Privilege Escalation |
| 9 | +date: 2013-02-21 |
| 10 | +description: | |
| 11 | + Spree contains a flaw that leads to unauthorized privileges being gained. The |
| 12 | + issue is triggered as certain input related to mass role assignment in |
| 13 | + app/models/spree/user.rb is not properly verified before being used to update |
| 14 | + a user. This may allow a remote attacker to assign arbitrary roles and gain |
| 15 | + elevated administrative privileges. |
| 16 | +cvss_v2: 4.0 |
| 17 | +unaffected_versions: |
| 18 | + - "< 1.0.0" |
| 19 | +patched_versions: |
| 20 | + - ">= 3.0.5" |
| 21 | +related: |
| 22 | + url: |
| 23 | + - https://nvd.nist.gov/vuln/detail/CVE-2013-2506 |
| 24 | + - https://rubygems.org/gems/spree_auth_devise/versions/1.3.1 |
| 25 | + - https://rubygems.org/gems/spree_auth_devise/versions/1.2.0 |
| 26 | + - https://github.com/spree/spree_auth_devise/commit/038d74771d3b5c13d13b738b73dfda1033a99f65 |
| 27 | + - https://github.com/spree/spree_auth_devise/commit/fda3ab9fb536c64fe18a9b78bb21c6176b3ea24d |
| 28 | + - https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed |
| 29 | + - https://web.archive.org/web/20160331131233/https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed |
| 30 | + - https://github.com/advisories/GHSA-jp57-9j37-5476 |
| 31 | +notes: | |
| 32 | + - patched_versions, cvss_v2, and Commit URLs from nvd.nist.gov URL. |
| 33 | + - (YANKED) https://rubygems.org/gems/spree_auth_devise/versions/1.3.0 |
| 34 | + - 1.1.6 not on https://rubygems.org/gems/spree_auth_devise/versions |
| 35 | + - osvdb from found osvdb.csv file: "90865;Spree app/models/spree/user.rb |
| 36 | + Mass Role Assignment Remote Privilege Escalation" |
| 37 | + - On 8/12/2026: Copilot said that this GHSA advisory's patched_versions |
| 38 | + field was updated on 3/7/2024 (could not find a reference) from |
| 39 | + - "~> 1.1.6" |
| 40 | + - "~> 1.2.0" |
| 41 | + - ">= 1.3.0" |
| 42 | + TO "3.0.5" so I have updated this file. |
| 43 | + - GHSA also had "Affecgted versions" >= 1.0.0, < 3.0.5" so added |
| 44 | + unaffected_versions field/value. |
0 commit comments