CVE-2014-0081
published 2014-02-20CVE-2014-0081: Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3…
PriorityP421medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
4.03%
89.5th percentile
Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.
Affected
133 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| actionpack_project | actionpack | >= 3.0.0 < 3.2.17 | 3.2.17 |
| actionpack_project | actionpack | >= 4.0.0 < 4.0.3 | 4.0.3 |
| debian | rails | < rails 2.3.14.1 (bookworm) | rails 2.3.14.1 (bookworm) |
| opensuse | opensuse | — | — |
| opensuse_project | opensuse | — | — |
| redhat | cloudforms | — | — |
| redhat | enterprise_linux | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
ghsa4.3MEDIUM
osv4.3MEDIUM
vendor_debian4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Rails vulnerable to Cross-site Scripting
ghsa·2017-10-24·CVSS 4.3
CVE-2014-0081 [MEDIUM] CWE-79 Rails vulnerable to Cross-site Scripting
Rails vulnerable to Cross-site Scripting
There is an XSS vulnerability in the `number_to_currency`, `number_to_percentage` and `number_to_human` helpers in Ruby on Rails. This vulnerability has been assigned the CVE identifier CVE-2014-0081.
Versions Affected: All.
Fixed Versions: 4.1.0.beta2, 4.0.3, 3.2.17.
Impact
These helpers allows users to nicely format a numeric value. Some of the parameters to the helper (format, negative_format and units) are not escaped correctly. Applications which pass user controlled data as one of these parameters are vulnerable to an XSS attack.
All users passing user controlled data to these parameters of the number helpers should either upgrade or use one of the workarounds immediately.
Releases
The 4.1.0.rc1, 4.0.3 and 3.2.17 releases are available at
OSV
Rails vulnerable to Cross-site Scripting
osv·2017-10-24·CVSS 4.3
CVE-2014-0081 [MEDIUM] Rails vulnerable to Cross-site Scripting
Rails vulnerable to Cross-site Scripting
There is an XSS vulnerability in the `number_to_currency`, `number_to_percentage` and `number_to_human` helpers in Ruby on Rails. This vulnerability has been assigned the CVE identifier CVE-2014-0081.
Versions Affected: All.
Fixed Versions: 4.1.0.beta2, 4.0.3, 3.2.17.
Impact
These helpers allows users to nicely format a numeric value. Some of the parameters to the helper (format, negative_format and units) are not escaped correctly. Applications which pass user controlled data as one of these parameters are vulnerable to an XSS attack.
All users passing user controlled data to these parameters of the number helpers should either upgrade or use one of the workarounds immediately.
Releases
The 4.1.0.rc1, 4.0.3 and 3.2.17 releases are available at
OSV
CVE-2014-0081: Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper
osv·2014-02-20·CVSS 4.3
CVE-2014-0081 [MEDIUM] CVE-2014-0081: Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper
Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.
Red Hat
rubygem-actionpack: number_to_currency, number_to_percentage and number_to_human XSS vulnerability
vendor_redhat·2014-02-18·CVSS 4.3
CVE-2014-0081 [MEDIUM] CWE-79 rubygem-actionpack: number_to_currency, number_to_percentage and number_to_human XSS vulnerability
rubygem-actionpack: number_to_currency, number_to_percentage and number_to_human XSS vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.
Statement: Red Hat OpenShift Enterprise 1.2 is now in Production 1 Phase of the support
and maintenance life cycle. This has been rated as having Moderate security
impact and is not currently planned to be addressed in future updates. For
additional information, refer to the Red Hat OpenShift Ent
Debian
CVE-2014-0081: rails - Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_vie...
vendor_debian·2014·CVSS 4.3
CVE-2014-0081 [MEDIUM] CVE-2014-0081: rails - Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_vie...
Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.
Scope: local
bookworm: resolved (fixed in 2.3.14.1)
bullseye: resolved (fixed in 2.3.14.1)
forky: resolved (fixed in 2.3.14.1)
sid: resolved (fixed in 2.3.14.1)
trixie: resolved (fixed in 2.3.14.1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-0081 rubygem-actionpack: number_to_currency, number_to_percentage and number_to_human XSS vulnerability [fedora-all]
bugzilla·2014-02-18·CVSS 4.3
CVE-2014-0081 [MEDIUM] CVE-2014-0081 rubygem-actionpack: number_to_currency, number_to_percentage and number_to_human XSS vulnerability [fedora-all]
CVE-2014-0081 rubygem-actionpack: number_to_currency, number_to_percentage and number_to_human XSS vulnerability [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes fi
Bugzilla
CVE-2014-0081 rubygem-actionpack: number_to_currency, number_to_percentage and number_to_human XSS vulnerability
bugzilla·2014-02-14·CVSS 4.3
CVE-2014-0081 [MEDIUM] CVE-2014-0081 rubygem-actionpack: number_to_currency, number_to_percentage and number_to_human XSS vulnerability
CVE-2014-0081 rubygem-actionpack: number_to_currency, number_to_percentage and number_to_human XSS vulnerability
Aaron Patterson of the Ruby on Rails project reports:
There is an XSS vulnerability in the number_to_currency, number_to_percentage
and number_to_human helpers in Ruby on Rails.
Versions Affected: All.
Fixed Versions: 4.1.0.beta2, 4.0.3, 3.2.17.
Impact
These helpers allows users to nicely format a numeric value. Some of the parameters
to the helper (format, negative_format and units) are not escaped correctly.
Application which pass user controlled data as one of these parameters are
vulnerable to an XSS attack.
All users passing user controlled data to these parameters of the number helpers
should either upgrade or use one of the workarounds immediately.
Discussion:
Crea
http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.htmlhttp://openwall.com/lists/oss-security/2014/02/18/8http://rhn.redhat.com/errata/RHSA-2014-0215.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0306.htmlhttp://secunia.com/advisories/57376http://www.securityfocus.com/bid/65647http://www.securitytracker.com/id/1029782https://groups.google.com/forum/message/raw?msg=rubyonrails-security/tfp6gZCtzr4/j8LUHmu7fIEJhttp://lists.opensuse.org/opensuse-updates/2014-02/msg00081.htmlhttp://openwall.com/lists/oss-security/2014/02/18/8http://rhn.redhat.com/errata/RHSA-2014-0215.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0306.htmlhttp://secunia.com/advisories/57376http://www.securityfocus.com/bid/65647http://www.securitytracker.com/id/1029782https://groups.google.com/forum/message/raw?msg=rubyonrails-security/tfp6gZCtzr4/j8LUHmu7fIEJ
2014-02-20
Published