netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-jp57-9j37-5476

Browse Source
This commit is contained in:
advisory-database[bot]
2023-07-03 21:55:21 +00:00
parent d94f230248
commit 99a4688537
1 changed files with 3 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-jp57-9j37-5476/GHSA-jp57-9j37-5476.json
+3 -7
View File
@@ -1,12 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jp57-9j37-5476",
"modified": "2023-01-27T00:19:17Z",
"modified": "2023-07-03T21:54:06Z",
"published": "2022-05-17T05:13:40Z",
"aliases": [
"CVE-2013-2506"
],
"summary": "spree_auth_devise allows remote authenticated users to assign arbitrary roles to themselves",
"summary": "spree_auth_devise allows remote authenticated users to assign themselves arbitrary roles",
"details": "`app/models/spree/user.rb` in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.",
"severity": [
@@ -57,17 +57,13 @@
"type": "PACKAGE",
"url": "https://github.com/spree/spree_auth_devise"
},
{
"type": "WEB",
"url": "https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20131207040639/https://rubygems.org/gems/spree_auth_devise/versions"
},
{
"type": "WEB",
"url": "http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed"
"url": "https://web.archive.org/web/20160331131233/https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed"
}
],
"database_specific": {