CVE-2013-2506

Опубликовано: 08 мар. 2013

Источник: nvd

CVSS2: 4

EPSS Низкий

Описание

app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:spreecommerce:spree:1.1.0:*:*:*:*:*:*:*

cpe:2.3:a:spreecommerce:spree:1.1.1:*:*:*:*:*:*:*

cpe:2.3:a:spreecommerce:spree:1.1.2:*:*:*:*:*:*:*

cpe:2.3:a:spreecommerce:spree:1.1.3:*:*:*:*:*:*:*

cpe:2.3:a:spreecommerce:spree:1.1.4:*:*:*:*:*:*:*

cpe:2.3:a:spreecommerce:spree:1.1.5:*:*:*:*:*:*:*

cpe:2.3:a:spreecommerce:spree:1.1.6:*:*:*:*:*:*:*

cpe:2.3:a:spreecommerce:spree:1.2.0:*:*:*:*:*:*:*

cpe:2.3:a:spreecommerce:spree:1.2.1:*:*:*:*:*:*:*

cpe:2.3:a:spreecommerce:spree:1.2.2:*:*:*:*:*:*:*

cpe:2.3:a:spreecommerce:spree:1.2.3:*:*:*:*:*:*:*

cpe:2.3:a:spreecommerce:spree:1.2.4:*:*:*:*:*:*:*

cpe:2.3:a:spreecommerce:spree:1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:spreecommerce:spree:1.3.1:*:*:*:*:*:*:*

cpe:2.3:a:spreecommerce:spree:1.3.2:*:*:*:*:*:*:*

EPSS

Процентиль: 39%

0.00171

Низкий

4 Medium

CVSS2

Дефекты

CWE-264

Связанные уязвимости

GHSA-jp57-9j37-5476

github

больше 3 лет назад

spree_auth_devise allows remote authenticated users to assign themselves arbitrary roles