CVE-2013-0233: Opensuse

Medium severity, CVSS 6.8. EPSS: 14.1% chance of exploitation in the next 30 days.

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.

Affected products

• Opensuse Opensuse: version 12.2 only
• Plataformatec Devise: version 1.5.0 only; version 1.5.1 only; version 1.5.2 only; version 1.5.3 only; version 2.0.0 only; version 2.0.1 only; …

Published 2013-04-25. Last modified 2026-06-16.