diff --git a/advisories/github-reviewed/2022/05/GHSA-jp57-9j37-5476/GHSA-jp57-9j37-5476.json b/advisories/github-reviewed/2022/05/GHSA-jp57-9j37-5476/GHSA-jp57-9j37-5476.json index 33c1033fb83..de55b572e4f 100644 --- a/advisories/github-reviewed/2022/05/GHSA-jp57-9j37-5476/GHSA-jp57-9j37-5476.json +++ b/advisories/github-reviewed/2022/05/GHSA-jp57-9j37-5476/GHSA-jp57-9j37-5476.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-jp57-9j37-5476", - "modified": "2023-01-27T00:19:17Z", + "modified": "2023-07-03T21:54:06Z", "published": "2022-05-17T05:13:40Z", "aliases": [ "CVE-2013-2506" ], - "summary": "spree_auth_devise allows remote authenticated users to assign arbitrary roles to themselves", + "summary": "spree_auth_devise allows remote authenticated users to assign themselves arbitrary roles", "details": "`app/models/spree/user.rb` in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.", "severity": [ @@ -57,17 +57,13 @@ "type": "PACKAGE", "url": "https://github.com/spree/spree_auth_devise" }, - { - "type": "WEB", - "url": "https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed" - }, { "type": "WEB", "url": "https://web.archive.org/web/20131207040639/https://rubygems.org/gems/spree_auth_devise/versions" }, { "type": "WEB", - "url": "http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed" + "url": "https://web.archive.org/web/20160331131233/https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed" } ], "database_specific": {