CVE-2013-0233

🗓️ 25 Apr 2013 23:00:00Reported by MendType

Devise gem does not perform type conversion in database queries, allowing security bypass.

Reporter	Title	Published	Views	Family All 20
Circl	CVE-2013-0233	29 May 201815:50	–	circl
CVE	CVE-2013-0233	25 Apr 201323:00	–	cve
Cvelist	CVE-2013-0233	25 Apr 201323:00	–	cvelist
Debian CVE	CVE-2013-0233	25 Apr 201323:00	–	debiancve
Github Security Blog	Devise does not properly perform type conversion when performing database queries	24 Oct 201718:33	–	github
Metasploit	Ruby on Rails Devise Authentication Password Reset	28 Jan 201300:00	–	metasploit
NVD	CVE-2013-0233	25 Apr 201323:55	–	nvd
Tenable Nessus	openSUSE Security Update : rubygem-devise (openSUSE-SU-2013:0374-1)	13 Jun 201400:00	–	nessus
osv_cve	CVE-2013-0233	25 Apr 201323:55	–	osv_cve
osv_debian	DEBIAN-CVE-2013-0233	25 Apr 201323:55	–	osv_debian

Vulners

Node

heartcombo deviseRange2.2.0–2.2.3

heartcombo deviseRange1.5.0–1.5.4

heartcombo deviseRange2.1.0–2.1.3

heartcombo deviseRange2.0.0–2.0.5

Source	Link
blog	www.blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released/
lists	www.lists.opensuse.org/opensuse-updates/2013-03/msg00000.html
web	www.web.archive.org/web/20200229103406/http://www.securityfocus.com/bid/57577
phenoelit	www.phenoelit.org/blog/archives/2013/02/05/mysql_madness_and_rails/index.html
metasploit	www.metasploit.com/modules/auxiliary/admin/http/rails_devise_pass_reset
nvd	www.nvd.nist.gov/vuln/detail/CVE-2013-0233
openwall	www.openwall.com/lists/oss-security/2013/01/29/3
web	www.web.archive.org/web/20140726005251/http://www.phenoelit.org/blog/archives/2013/02/05/mysql_madness_and_rails/index.html
blog	www.blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released
securityfocus	www.securityfocus.com/bid/57577

04 Oct 2026 01:59Current

CVSS 3.15.6

CVSS 46.3

CVSS 26.8

EPSS0.14126