CVEvulnerability
CVE-2013-2506
4.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2013-03-08
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-264
Description
app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.
Affected configurations
• spreecommerce spree 1.1.0
• spreecommerce spree 1.1.1
• spreecommerce spree 1.1.2
• spreecommerce spree 1.1.3
• spreecommerce spree 1.1.4
• spreecommerce spree 1.1.5
• spreecommerce spree 1.1.6
• spreecommerce spree 1.2.0
• spreecommerce spree 1.2.1
• spreecommerce spree 1.2.2
• spreecommerce spree 1.2.3
• spreecommerce spree 1.2.4
• spreecommerce spree 1.3.0
• spreecommerce spree 1.3.1
• spreecommerce spree 1.3.2
Related
Weakness · not in database (1)
References
- http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed Vendor Advisory
- https://github.com/spree/spree_auth_devise/commit/038d74771d3b5c13d13b738b73dfda1033a99f65 github.com
- http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed Vendor Advisory
- https://github.com/spree/spree_auth_devise/commit/038d74771d3b5c13d13b738b73dfda1033a99f65 github.com