« Volver al listado

CVE-2013-2506

Estado: ModificadaMedia (4)—

app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Spreecommerce — Spree

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-2506",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-03-08T18:55:01.773",
  "references": [
    {
      "url": "http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/spree/spree_auth_devise/commit/038d74771d3b5c13d13b738b73dfda1033a99f65",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/spree/spree_auth_devise/commit/038d74771d3b5c13d13b738b73dfda1033a99f65",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves."
    },
    {
      "lang": "es",
      "value": "app/models/spree/user.rb en spree_auth_devise en Spree v1.1.x antes de v1.1.6, v1.2.x, y v1.3.x no lleva a cabo una asignación autorizada de forma segura cuando se actualiza un usuario, lo que permite a usuarios remotos autenticados asignar funciones de su elección a sí mismos.\r\n"
    }
  ],
  "lastModified": "2026-06-16T23:53:35.673",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:spreecommerce:spree:1.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E4C456B-99E3-4550-9F03-74E828EADC49"
            },
            {
              "criteria": "cpe:2.3:a:spreecommerce:spree:1.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8AE2CB0-58FE-485F-8722-0F6799FEE97B"
            },
            {
              "criteria": "cpe:2.3:a:spreecommerce:spree:1.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7B1C92A9-CDC0-422F-868A-1DEF9887BC27"
            },
            {
              "criteria": "cpe:2.3:a:spreecommerce:spree:1.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8A05B3F-8F92-421E-A18B-FEEB9EF672A9"
            },
            {
              "criteria": "cpe:2.3:a:spreecommerce:spree:1.1.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B58ACE5-EA8E-4266-BC0C-86B34439BA1C"
            },
            {
              "criteria": "cpe:2.3:a:spreecommerce:spree:1.1.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3258380-E9CA-4F59-92BD-E568B7FE823F"
            },
            {
              "criteria": "cpe:2.3:a:spreecommerce:spree:1.1.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5A0F16F-EEA6-496A-83CC-EE87DF06195F"
            },
            {
              "criteria": "cpe:2.3:a:spreecommerce:spree:1.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4A78A39-0D61-4935-927A-EAFC904D1BD3"
            },
            {
              "criteria": "cpe:2.3:a:spreecommerce:spree:1.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7E9A11C-BDAC-4F21-B165-9CB6636FD45B"
            },
            {
              "criteria": "cpe:2.3:a:spreecommerce:spree:1.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8CD9FB6C-D1C5-4D96-88B6-C24C36EF4679"
            },
            {
              "criteria": "cpe:2.3:a:spreecommerce:spree:1.2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B3C7D8B-3BF3-47FE-9197-5171A07ED7D2"
            },
            {
              "criteria": "cpe:2.3:a:spreecommerce:spree:1.2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3015DFDE-8BAB-4A85-BAC4-370FDE089C0E"
            },
            {
              "criteria": "cpe:2.3:a:spreecommerce:spree:1.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F31E7395-CCA8-4ABE-8461-83F152D52443"
            },
            {
              "criteria": "cpe:2.3:a:spreecommerce:spree:1.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "75DA34B2-C070-4457-9623-371E8DF8B648"
            },
            {
              "criteria": "cpe:2.3:a:spreecommerce:spree:1.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FC5AB60-888B-4C05-A5F9-178538B30592"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}