CVE-2013-2506: Permissions, Privileges, and Access Controls

March 8, 2013 (updated March 18, 2013)

app/models/spree/user.rb in spree_auth_devise in Spree does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.

References

spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
github.com/spree/spree_auth_devise/commit/038d74771d3b5c13d13b738b73dfda1033a99f65
nvd.nist.gov/vuln/detail/CVE-2013-2506

Code Behaviors & Features

Detect and mitigate CVE-2013-2506 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →