CVE catalog
CVE-2013-0233
ruby-devise: CVE-2013-0233
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 14.13% · Oct 25, 2026
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | ruby-devise | bookworm | 4.8.1-1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | ruby-devise | source | bookworm | 3.4.1-1 | not yet assigned | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [ruby-devise]Fixed
Details (2)
4.8.1-1· all · bookwormFixed · Fixed:
3.4.1-1dsa · ruby-devise · debian · bookworm; dsa · ruby-devise · debian · 12
4.8.1-1· all · bookwormFixed · Fixed:
3.4.1-1dsa · ruby-devise · debian · bookworm; dsa · ruby-devise · debian · 12
Observed: