CVE-2013-2506: Permissions, Privileges, and Access Controls

March 8, 2013 (updated March 18, 2013)

app/models/spree/user.rb in spree_auth_devise in Spree does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.

References

spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
github.com/spree/spree_auth_devise/commit/038d74771d3b5c13d13b738b73dfda1033a99f65
nvd.nist.gov/vuln/detail/CVE-2013-2506

Code Behaviors & Features

Detect and mitigate CVE-2013-2506 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →