{"id":"GHSA-jp57-9j37-5476","summary":"spree_auth_devise allows remote authenticated users to assign themselves arbitrary roles","details":"`app/models/spree/user.rb` in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.","aliases":["CVE-2013-2506"],"modified":"2024-12-07T05:38:59.527116Z","published":"2022-05-17T05:13:40Z","database_specific":{"nvd_published_at":"2013-03-08T18:55:00Z","cwe_ids":[],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2023-01-27T00:19:17Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2506"},{"type":"WEB","url":"https://github.com/spree/spree_auth_devise/commit/038d74771d3b5c13d13b738b73dfda1033a99f65"},{"type":"WEB","url":"https://github.com/spree/spree_auth_devise/commit/fda3ab9fb536c64fe18a9b78bb21c6176b3ea24d"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_auth/CVE-2013-2506.yml"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree_auth_devise/CVE-2013-2506.yml"},{"type":"PACKAGE","url":"https://github.com/spree/spree_auth_devise"},{"type":"WEB","url":"https://web.archive.org/web/20131207040639/https://rubygems.org/gems/spree_auth_devise/versions"},{"type":"WEB","url":"https://web.archive.org/web/20160331131233/https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed"}],"affected":[{"package":{"name":"spree_auth_devise","ecosystem":"RubyGems","purl":"pkg:gem/spree_auth_devise"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"3.0.5"}]}],"versions":["1.0.0","1.0.1","1.2.0","1.3.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-jp57-9j37-5476/GHSA-jp57-9j37-5476.json"}}],"schema_version":"1.9.0"}