CVE-2013-0233
23Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 14%
from disclosure to weapon0 days
Published on NVDApr 25
metasploitJan 28
exploitation probability
14%top 4% of all CVEs
observed exploitation
nono source reports it
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
Affected products
n/a · n/aReferences
http://blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released/http://lists.opensuse.org/opensuse-updates/2013-03/msg00000.htmlhttps://github.com/Snorby/snorby/issues/261http://www.metasploit.com/modules/auxiliary/admin/http/rails_devise_pass_resethttp://www.openwall.com/lists/oss-security/2013/01/29/3http://www.phenoelit.org/blog/archives/2013/02/05/mysql_madness_and_rails/index.htmlhttp://www.securityfocus.com/bid/57577