Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-0081

Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.

Published

2014-02-20T15:27:09.140

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	rubyonrails	rails	0.9.1	Yes
Application	rubyonrails	rails	0.9.2	Yes
Application	rubyonrails	rails	0.9.3	Yes
Application	rubyonrails	rails	0.9.4	Yes
Application	rubyonrails	rails	0.9.4.1	Yes
Application	rubyonrails	rails	0.10.0	Yes
Application	rubyonrails	rails	0.10.1	Yes
Application	rubyonrails	rails	0.11.0	Yes
Application	rubyonrails	rails	0.11.1	Yes
Application	rubyonrails	rails	0.12.0	Yes
Application	rubyonrails	rails	0.12.1	Yes
Application	rubyonrails	rails	0.13.0	Yes
Application	rubyonrails	rails	0.13.1	Yes
Application	rubyonrails	rails	0.14.1	Yes
Application	rubyonrails	rails	0.14.2	Yes
Application	rubyonrails	rails	0.14.3	Yes
Application	rubyonrails	rails	0.14.4	Yes
Application	rubyonrails	rails	1.0.0	Yes
Application	rubyonrails	rails	1.1.0	Yes
Application	rubyonrails	rails	1.1.1	Yes
Application	rubyonrails	rails	1.1.2	Yes
Application	rubyonrails	rails	1.1.3	Yes
Application	rubyonrails	rails	1.1.4	Yes
Application	rubyonrails	rails	1.1.5	Yes
Application	rubyonrails	rails	1.1.6	Yes
Application	rubyonrails	rails	1.2.0	Yes
Application	rubyonrails	rails	1.2.1	Yes
Application	rubyonrails	rails	1.2.2	Yes
Application	rubyonrails	rails	1.2.3	Yes
Application	rubyonrails	rails	1.2.4	Yes
Application	rubyonrails	rails	1.2.5	Yes
Application	rubyonrails	rails	1.2.6	Yes
Application	rubyonrails	rails	1.9.5	Yes
Application	rubyonrails	rails	2.0.0	Yes
Application	rubyonrails	rails	2.0.0	Yes
Application	rubyonrails	rails	2.0.0	Yes
Application	rubyonrails	rails	2.0.1	Yes
Application	rubyonrails	rails	2.0.2	Yes
Application	rubyonrails	rails	2.0.4	Yes
Application	rubyonrails	rails	2.1.0	Yes
Application	rubyonrails	rails	2.1.1	Yes
Application	rubyonrails	rails	2.1.2	Yes
Application	rubyonrails	rails	2.2.0	Yes
Application	rubyonrails	rails	2.2.1	Yes
Application	rubyonrails	rails	2.2.2	Yes
Application	rubyonrails	rails	2.3.0	Yes
Application	rubyonrails	rails	2.3.1	Yes
Application	rubyonrails	rails	2.3.2	Yes
Application	rubyonrails	rails	2.3.3	Yes
Application	rubyonrails	rails	2.3.4	Yes
Application	rubyonrails	rails	2.3.9	Yes
Application	rubyonrails	rails	2.3.10	Yes
Application	rubyonrails	rails	2.3.11	Yes
Application	rubyonrails	rails	2.3.12	Yes
Application	rubyonrails	rails	2.3.13	Yes
Application	rubyonrails	rails	2.3.14	Yes
Application	rubyonrails	rails	2.3.15	Yes
Application	rubyonrails	rails	2.3.16	Yes
Application	rubyonrails	rails	3.0.0	Yes
Application	rubyonrails	rails	3.0.0	Yes
Application	rubyonrails	rails	3.0.0	Yes
Application	rubyonrails	rails	3.0.0	Yes
Application	rubyonrails	rails	3.0.0	Yes
Application	rubyonrails	rails	3.0.0	Yes
Application	rubyonrails	rails	3.0.0	Yes
Application	rubyonrails	rails	3.0.1	Yes
Application	rubyonrails	rails	3.0.1	Yes
Application	rubyonrails	rails	3.0.2	Yes
Application	rubyonrails	rails	3.0.2	Yes
Application	rubyonrails	rails	3.0.3	Yes
Application	rubyonrails	rails	3.0.4	Yes
Application	rubyonrails	rails	3.0.5	Yes
Application	rubyonrails	rails	3.0.5	Yes
Application	rubyonrails	rails	3.0.6	Yes
Application	rubyonrails	rails	3.0.6	Yes
Application	rubyonrails	rails	3.0.6	Yes
Application	rubyonrails	rails	3.0.7	Yes
Application	rubyonrails	rails	3.0.7	Yes
Application	rubyonrails	rails	3.0.7	Yes
Application	rubyonrails	rails	3.0.8	Yes
Application	rubyonrails	rails	3.0.8	Yes
Application	rubyonrails	rails	3.0.8	Yes
Application	rubyonrails	rails	3.0.8	Yes
Application	rubyonrails	rails	3.0.8	Yes
Application	rubyonrails	rails	3.0.9	Yes
Application	rubyonrails	rails	3.0.9	Yes
Application	rubyonrails	rails	3.0.9	Yes
Application	rubyonrails	rails	3.0.9	Yes
Application	rubyonrails	rails	3.0.9	Yes
Application	rubyonrails	rails	3.0.9	Yes
Application	rubyonrails	rails	3.0.10	Yes
Application	rubyonrails	rails	3.0.10	Yes
Application	rubyonrails	rails	3.0.11	Yes
Application	rubyonrails	rails	3.0.12	Yes
Application	rubyonrails	rails	3.0.12	Yes
Application	rubyonrails	rails	3.0.13	Yes
Application	rubyonrails	rails	3.0.13	Yes
Application	rubyonrails	rails	3.0.14	Yes
Application	rubyonrails	rails	3.0.16	Yes
Application	rubyonrails	rails	3.0.17	Yes
Application	rubyonrails	rails	3.0.18	Yes
Application	rubyonrails	rails	3.0.19	Yes
Application	rubyonrails	rails	3.0.20	Yes
Application	rubyonrails	rails	3.1.0	Yes
Application	rubyonrails	rails	3.1.0	Yes
Application	rubyonrails	rails	3.1.0	Yes
Application	rubyonrails	rails	3.1.0	Yes
Application	rubyonrails	rails	3.1.0	Yes
Application	rubyonrails	rails	3.1.0	Yes
Application	rubyonrails	rails	3.1.0	Yes
Application	rubyonrails	rails	3.1.0	Yes
Application	rubyonrails	rails	3.1.0	Yes
Application	rubyonrails	rails	3.1.0	Yes
Application	rubyonrails	rails	3.1.1	Yes
Application	rubyonrails	rails	3.1.1	Yes
Application	rubyonrails	rails	3.1.1	Yes
Application	rubyonrails	rails	3.1.1	Yes
Application	rubyonrails	rails	3.1.2	Yes
Application	rubyonrails	rails	3.1.2	Yes
Application	rubyonrails	rails	3.1.2	Yes
Application	rubyonrails	rails	3.1.3	Yes
Application	rubyonrails	rails	3.1.4	Yes
Application	rubyonrails	rails	3.1.4	Yes
Application	rubyonrails	rails	3.1.5	Yes
Application	rubyonrails	rails	3.1.5	Yes
Application	rubyonrails	rails	3.1.6	Yes
Application	rubyonrails	rails	3.1.7	Yes
Application	rubyonrails	rails	3.1.8	Yes
Application	rubyonrails	rails	3.1.9	Yes
Application	rubyonrails	rails	3.1.10	Yes
Application	rubyonrails	rails	3.2.0	Yes
Application	rubyonrails	rails	3.2.0	Yes
Application	rubyonrails	rails	3.2.0	Yes
Application	rubyonrails	rails	3.2.1	Yes
Application	rubyonrails	rails	3.2.2	Yes
Application	rubyonrails	rails	3.2.2	Yes
Application	rubyonrails	rails	3.2.3	Yes
Application	rubyonrails	rails	3.2.3	Yes
Application	rubyonrails	rails	3.2.3	Yes
Application	rubyonrails	rails	3.2.4	Yes
Application	rubyonrails	rails	3.2.4	Yes
Application	rubyonrails	rails	3.2.5	Yes
Application	rubyonrails	rails	3.2.6	Yes
Application	rubyonrails	rails	3.2.7	Yes
Application	rubyonrails	rails	3.2.8	Yes
Application	rubyonrails	rails	3.2.9	Yes
Application	rubyonrails	rails	3.2.10	Yes
Application	rubyonrails	rails	3.2.11	Yes
Application	rubyonrails	rails	3.2.12	Yes
Application	rubyonrails	rails	3.2.13	Yes
Application	rubyonrails	rails	3.2.13	Yes
Application	rubyonrails	rails	3.2.13	Yes
Application	rubyonrails	rails	3.2.15	Yes
Application	rubyonrails	rails	3.2.15	Yes
Application	rubyonrails	rails	4.0.0	Yes
Application	rubyonrails	rails	4.0.0	Yes
Application	rubyonrails	rails	4.0.0	Yes
Application	rubyonrails	rails	4.0.0	Yes
Application	rubyonrails	rails	4.0.1	Yes
Application	rubyonrails	rails	4.0.1	Yes
Application	rubyonrails	rails	4.0.1	Yes
Application	rubyonrails	rails	4.0.1	Yes
Application	rubyonrails	rails	4.0.1	Yes
Application	rubyonrails	rails	4.0.2	Yes
Application	rubyonrails	rails	4.1.0	Yes
Application	rubyonrails	ruby_on_rails	≤ 3.2.16	Yes
Application	rubyonrails	ruby_on_rails	0.5.0	Yes
Application	rubyonrails	ruby_on_rails	0.5.5	Yes
Application	rubyonrails	ruby_on_rails	0.5.6	Yes
Application	rubyonrails	ruby_on_rails	0.5.7	Yes
Application	rubyonrails	ruby_on_rails	0.6.0	Yes
Application	rubyonrails	ruby_on_rails	0.6.5	Yes
Application	rubyonrails	ruby_on_rails	0.7.0	Yes
Application	rubyonrails	ruby_on_rails	0.8.0	Yes
Application	rubyonrails	ruby_on_rails	0.8.5	Yes
Application	rubyonrails	ruby_on_rails	0.9.0	Yes
Application	rubyonrails	ruby_on_rails	3.0.4	Yes
Application	rubyonrails	ruby_on_rails	3.2.14	Yes
Application	rubyonrails	ruby_on_rails	3.2.14	Yes
Application	rubyonrails	ruby_on_rails	3.2.14	Yes
Application	rubyonrails	ruby_on_rails	3.2.15	Yes
Application	rubyonrails	ruby_on_rails	3.2.15	Yes
Operating System	opensuse	opensuse	13.1	Yes
Operating System	opensuse_project	opensuse	12.3	Yes
Application	redhat	cloudforms	3.0	Yes
Operating System	redhat	enterprise_linux	6.0	Yes

References

http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html Third Party Advisory ([email protected])
http://openwall.com/lists/oss-security/2014/02/18/8 Third Party Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2014-0215.html Third Party Advisory ([email protected])
http://rhn.redhat.com/errata/RHSA-2014-0306.html Third Party Advisory ([email protected])
http://secunia.com/advisories/57376 Permissions Required ([email protected])
http://www.securityfocus.com/bid/65647 Third Party Advisory, VDB Entry ([email protected])
http://www.securitytracker.com/id/1029782 Third Party Advisory, VDB Entry ([email protected])
https://groups.google.com/forum/message/raw?msg=rubyonrails-security/tfp6gZCtzr4/j8LUHmu7fIEJ Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://openwall.com/lists/oss-security/2014/02/18/8 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2014-0215.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2014-0306.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/57376 Permissions Required (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/65647 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id/1029782 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://groups.google.com/forum/message/raw?msg=rubyonrails-security/tfp6gZCtzr4/j8LUHmu7fIEJ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)