CVE-2013-0233 json
Devise does not properly perform type conversion when performing database queries
published 2013-04-25 13 y ago modified 2026-06-16 4 mo ago also GHSA-jxhw-mg8m-2pj8 , EUVD-2017-0267
- cvss
- 6.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 14.1%
- EPSS 14.1% chance of exploitation in 30 days, percentile 96%
- public exploits
- 1
- Metasploit
Summary
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
Patch / fix
- rubygems devise 1.5.4, 2.0.5, 2.1.3, 2.2.3
- ruby-devise Debian 12 3.4.1-1
debian advisories DEBIAN-CVE-2013-0233
Timeline
- First public exploit (Metasploit auxiliary/admin/http/rails_devise_pass_reset)
- Published
Exploit prediction
14.13% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit auxiliary/admin/http/rails_devise_pass_reset Ruby on Rails Devise Authentication Password Reset metasploit auxiliary, normal rank, 2013-01-28
- metasploit.com http://www.metasploit.com/modules/auxiliary/admin/http/rails_devise_pass_reset referenced PoC, tagged "exploit" by a source, unverified
- phenoelit.org http://www.phenoelit.org/blog/archives/2013/02/05/mysql_madness_and_rails/index.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | devise | >=2.2.0, <2.2.3 >=2.1.0, <2.1.3 >=2.0.0, <2.0.5 >=1.5.0, <1.5.4 |
2.2.3 2.1.3 2.0.5 1.5.4 |
Classification
References
-
metasploit.com
/modules/auxiliary/admin/http/rails_devise_pass_reset
web, exploit
-
phenoelit.org
/blog/archives/2013/02/05/mysql_madness_and_rails/index.html
exploit
-
lists.opensuse.org
/opensuse-updates/2013-03/msg00000.html
vendor-advisory, web
-
blog.plataformatec.com.br
/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released/
vendor-advisory
-
openwall.com
/lists/oss-security/2013/01/29/3
mailing-list, web
-
securityfocus.com
/bid/57577
vdb-entry
-
github.com
/Snorby/snorby/issues/261
web
-
nvd.nist.gov
/vuln/detail/CVE-2013-0233
advisory
-
web.archive.org
/web/20140726005251/http://www.phenoelit.org/blog/archives/2013/02/05/mysql_madness_and_rails/index.html
web
-
web.archive.org
/web/20200229103406/http://www.securityfocus.com/bid/57577
web
-
blog.plataformatec.com.br
/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released
web
Sources
- CVE List CVE-2013-0233
- GitHub Advisory GHSA-jxhw-mg8m-2pj8
- NVD CVE-2013-0233
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.