Spree app/models/spree/user.rb Mass Role Assignment Remote Privilege Escalation
Published: February 21, 2013
SECURITY IDENTIFIERS
- CVE: CVE-2013-2506 (NVD)
- GHSA: GHSA-jp57-9j37-5476
- OSVDB: OSVDB-90865
GEM
SEVERITY
CVSS v2.0: 4.0 (Medium)
UNAFFECTED VERSIONS
< 1.0.0
PATCHED VERSIONS
>= 3.0.5
DESCRIPTION
Spree contains a flaw that leads to unauthorized privileges being gained. The issue is triggered as certain input related to mass role assignment in app/models/spree/user.rb is not properly verified before being used to update a user. This may allow a remote attacker to assign arbitrary roles and gain elevated administrative privileges.
RELATED
- https://nvd.nist.gov/vuln/detail/CVE-2013-2506
- https://rubygems.org/gems/spree_auth_devise/versions/1.3.1
- https://rubygems.org/gems/spree_auth_devise/versions/1.2.0
- https://github.com/spree/spree_auth_devise/commit/038d74771d3b5c13d13b738b73dfda1033a99f65
- https://github.com/spree/spree_auth_devise/commit/fda3ab9fb536c64fe18a9b78bb21c6176b3ea24d
- https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
- https://web.archive.org/web/20160331131233/https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
- https://github.com/advisories/GHSA-jp57-9j37-5476