What’s Vulnerable › Vulnerabilities

CVE-2013-2506

• Severity: medium (CVSS 4.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2013-03-08 · updated 2026-06-16
• Weakness: CWE-264

Description

app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.

Affected products

• spree: 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5 (+9)

References

• http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
• https://github.com/spree/spree_auth_devise/commit/038d74771d3b5c13d13b738b73dfda1033a99f65
• http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
• https://github.com/spree/spree_auth_devise/commit/038d74771d3b5c13d13b738b73dfda1033a99f65

Get alerted when CVE-2013-2506 or the next vulnerability affects your stack