Read the docs
TI-2013-00167 Aliases CVE-2013-0233GHSA-jxhw-mg8m-2pj8

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before…

Priority MEDIUM 45CWE-399Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-399 and the CVSS impact.

Summary

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.

Why it matters now

EPSS 0.14126 96th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed devise (RubyGems): 2.2.3, 2.1.3, 2.0.5 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—devise (RubyGems)2.2.0 to before 2.2.32.2.3Patch availableGHSA-jxhw-mg8m-2pj8
—devise (RubyGems)2.1.0 to before 2.1.32.1.3Patch availableGHSA-jxhw-mg8m-2pj8
—devise (RubyGems)2.0.0 to before 2.0.52.0.5Patch availableGHSA-jxhw-mg8m-2pj8
—devise (RubyGems)1.5.0 to before 1.5.41.5.4Patch availableGHSA-jxhw-mg8m-2pj8
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • devise (RubyGems) Vendor— Affected 2.2.0 to before 2.2.3 Fixed in 2.2.3 Patch available GHSA-jxhw-mg8m-2pj8
  • devise (RubyGems) Vendor— Affected 2.1.0 to before 2.1.3 Fixed in 2.1.3 Patch available GHSA-jxhw-mg8m-2pj8
  • devise (RubyGems) Vendor— Affected 2.0.0 to before 2.0.5 Fixed in 2.0.5 Patch available GHSA-jxhw-mg8m-2pj8
  • devise (RubyGems) Vendor— Affected 1.5.0 to before 1.5.4 Fixed in 1.5.4 Patch available GHSA-jxhw-mg8m-2pj8

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:plataformatec:devise:1.5.0:*:*:*:*:*:*:*1.5.0VulnerablePlataformatec
cpe:2.3:a:plataformatec:devise:1.5.1:*:*:*:*:*:*:*1.5.1VulnerablePlataformatec
cpe:2.3:a:plataformatec:devise:1.5.2:*:*:*:*:*:*:*1.5.2VulnerablePlataformatec
cpe:2.3:a:plataformatec:devise:1.5.3:*:*:*:*:*:*:*1.5.3VulnerablePlataformatec
cpe:2.3:a:plataformatec:devise:2.0.0:*:*:*:*:*:*:*2.0.0VulnerablePlataformatec
cpe:2.3:a:plataformatec:devise:2.0.1:*:*:*:*:*:*:*2.0.1VulnerablePlataformatec
cpe:2.3:a:plataformatec:devise:2.0.2:*:*:*:*:*:*:*2.0.2VulnerablePlataformatec
cpe:2.3:a:plataformatec:devise:2.0.3:*:*:*:*:*:*:*2.0.3VulnerablePlataformatec
cpe:2.3:a:plataformatec:devise:2.0.4:*:*:*:*:*:*:*2.0.4VulnerablePlataformatec
cpe:2.3:a:plataformatec:devise:2.1.0:*:*:*:*:*:*:*2.1.0VulnerablePlataformatec
  • cpe:2.3:a:plataformatec:devise:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Plataformatec
  • cpe:2.3:a:plataformatec:devise:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·Plataformatec
  • cpe:2.3:a:plataformatec:devise:1.5.2:*:*:*:*:*:*:* Versions 1.5.2 Vulnerable ·Plataformatec
  • cpe:2.3:a:plataformatec:devise:1.5.3:*:*:*:*:*:*:* Versions 1.5.3 Vulnerable ·Plataformatec
  • cpe:2.3:a:plataformatec:devise:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Plataformatec
  • cpe:2.3:a:plataformatec:devise:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Plataformatec
  • cpe:2.3:a:plataformatec:devise:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·Plataformatec
  • cpe:2.3:a:plataformatec:devise:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·Plataformatec
  • cpe:2.3:a:plataformatec:devise:2.0.4:*:*:*:*:*:*:* Versions 2.0.4 Vulnerable ·Plataformatec
  • cpe:2.3:a:plataformatec:devise:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Plataformatec
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:plataformatec:devise:2.1.1:*:*:*:*:*:*:*2.1.1VulnerablePlataformatec
cpe:2.3:a:plataformatec:devise:2.1.2:*:*:*:*:*:*:*2.1.2VulnerablePlataformatec
cpe:2.3:a:plataformatec:devise:2.2.0:*:*:*:*:*:*:*2.2.0VulnerablePlataformatec
cpe:2.3:a:plataformatec:devise:2.2.1:*:*:*:*:*:*:*2.2.1VulnerablePlataformatec
cpe:2.3:a:plataformatec:devise:2.2.2:*:*:*:*:*:*:*2.2.2VulnerablePlataformatec
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*all versionsRunning onruby
cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*12.2VulnerableopenSUSE
  • cpe:2.3:a:plataformatec:devise:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Plataformatec
  • cpe:2.3:a:plataformatec:devise:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·Plataformatec
  • cpe:2.3:a:plataformatec:devise:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Plataformatec
  • cpe:2.3:a:plataformatec:devise:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Plataformatec
  • cpe:2.3:a:plataformatec:devise:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·Plataformatec
  • cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* Versions all versions Running on ·ruby
  • cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:* Versions 12.2 Vulnerable ·openSUSE

Remediation

  • Fix · GHSA-jxhw-mg8m-2pj8 devise (RubyGems) Fixed in 2.2.3 Advisory →
  • Fix · GHSA-jxhw-mg8m-2pj8 devise (RubyGems) Fixed in 2.1.3 Advisory →
  • Fix · GHSA-jxhw-mg8m-2pj8 devise (RubyGems) Fixed in 2.0.5 Advisory →
  • Fix · GHSA-jxhw-mg8m-2pj8 devise (RubyGems) Fixed in 1.5.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-0233
  2. 2026-10-03 Alias added: GHSA-jxhw-mg8m-2pj8

References

Exploit 2

Advisory 3

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences