CVE-2014-0081

Ruby on Rails < 3.2.17, 4.0.x < 4.0.3, 4.1.x < 4.1.0.beta2 - Cross-Site Scripting via Number Helper Parameters

Title source: llm
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.

References (8)

Core 8
Core References
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-0215.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-0306.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/65647
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1029782
Third Party Advisory mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2014/02/18/8
Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html
Permissions Required third-party-advisory x_refsource_secunia
http://secunia.com/advisories/57376

Scores

EPSS 0.0089
EPSS Percentile 75.7%

Details

CWE
CWE-79
Status published
Products (48)
opensuse/opensuse 13.1
opensuse_project/opensuse 12.3
redhat/cloudforms 3.0
redhat/enterprise_linux 6.0
rubygems/actionpack 3.0.0 - 3.2.17RubyGems
rubygems/rails 3.0.0 - 3.2.17RubyGems
rubyonrails/rails 0.9.1
rubyonrails/rails 0.9.2
rubyonrails/rails 0.9.3
rubyonrails/rails 0.9.4
... and 38 more
Published Feb 20, 2014
Tracked Since Feb 18, 2026