Lucene search
HistoryFeb 20, 2014 - 3:27 p.m.
CVE-2014-0081
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
5.6 Medium
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
59.1%
Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or © number_to_human helper.
Affected configurations
Node
rubyonrailsrailsMatch0.9.1
ORrubyonrailsrailsMatch0.9.2
ORrubyonrailsrailsMatch0.9.3
ORrubyonrailsrailsMatch0.9.4
ORrubyonrailsrailsMatch0.9.4.1
ORrubyonrailsrailsMatch0.10.0
ORrubyonrailsrailsMatch0.10.1
ORrubyonrailsrailsMatch0.11.0
ORrubyonrailsrailsMatch0.11.1
ORrubyonrailsrailsMatch0.12.0
ORrubyonrailsrailsMatch0.12.1
ORrubyonrailsrailsMatch0.13.0
ORrubyonrailsrailsMatch0.13.1
ORrubyonrailsrailsMatch0.14.1
ORrubyonrailsrailsMatch0.14.2
ORrubyonrailsrailsMatch0.14.3
ORrubyonrailsrailsMatch0.14.4
ORrubyonrailsrailsMatch1.0.0
ORrubyonrailsrailsMatch1.1.0
ORrubyonrailsrailsMatch1.1.1
ORrubyonrailsrailsMatch1.1.2
ORrubyonrailsrailsMatch1.1.3
ORrubyonrailsrailsMatch1.1.4
ORrubyonrailsrailsMatch1.1.5
ORrubyonrailsrailsMatch1.1.6
ORrubyonrailsrailsMatch1.2.0
ORrubyonrailsrailsMatch1.2.1
ORrubyonrailsrailsMatch1.2.2
ORrubyonrailsrailsMatch1.2.3
ORrubyonrailsrailsMatch1.2.4
ORrubyonrailsrailsMatch1.2.5
ORrubyonrailsrailsMatch1.2.6
ORrubyonrailsrailsMatch1.9.5
ORrubyonrailsrailsMatch2.0.0
ORrubyonrailsrailsMatch2.0.0rc1
ORrubyonrailsrailsMatch2.0.0rc2
ORrubyonrailsrailsMatch2.0.1
ORrubyonrailsrailsMatch2.0.2
ORrubyonrailsrailsMatch2.0.4
ORrubyonrailsrailsMatch2.1.0
ORrubyonrailsrailsMatch2.1.1
ORrubyonrailsrailsMatch2.1.2
ORrubyonrailsrailsMatch2.2.0
ORrubyonrailsrailsMatch2.2.1
ORrubyonrailsrailsMatch2.2.2
ORrubyonrailsrailsMatch2.3.0
ORrubyonrailsrailsMatch2.3.1
ORrubyonrailsrailsMatch2.3.2
ORrubyonrailsrailsMatch2.3.3
ORrubyonrailsrailsMatch2.3.4
ORrubyonrailsrailsMatch2.3.9
ORrubyonrailsrailsMatch2.3.10
ORrubyonrailsrailsMatch2.3.11
ORrubyonrailsrailsMatch2.3.12
ORrubyonrailsrailsMatch2.3.13
ORrubyonrailsrailsMatch2.3.14
ORrubyonrailsrailsMatch2.3.15
ORrubyonrailsrailsMatch2.3.16
ORrubyonrailsrailsMatch3.0.0
ORrubyonrailsrailsMatch3.0.0beta
ORrubyonrailsrailsMatch3.0.0beta2
ORrubyonrailsrailsMatch3.0.0beta3
ORrubyonrailsrailsMatch3.0.0beta4
ORrubyonrailsrailsMatch3.0.0rc
ORrubyonrailsrailsMatch3.0.0rc2
ORrubyonrailsrailsMatch3.0.1
ORrubyonrailsrailsMatch3.0.1pre
ORrubyonrailsrailsMatch3.0.2
ORrubyonrailsrailsMatch3.0.2pre
ORrubyonrailsrailsMatch3.0.3
ORrubyonrailsrailsMatch3.0.4rc1
ORrubyonrailsrailsMatch3.0.5
ORrubyonrailsrailsMatch3.0.5rc1
ORrubyonrailsrailsMatch3.0.6
ORrubyonrailsrailsMatch3.0.6rc1
ORrubyonrailsrailsMatch3.0.6rc2
ORrubyonrailsrailsMatch3.0.7
ORrubyonrailsrailsMatch3.0.7rc1
ORrubyonrailsrailsMatch3.0.7rc2
ORrubyonrailsrailsMatch3.0.8
ORrubyonrailsrailsMatch3.0.8rc1
ORrubyonrailsrailsMatch3.0.8rc2
ORrubyonrailsrailsMatch3.0.8rc3
ORrubyonrailsrailsMatch3.0.8rc4
ORrubyonrailsrailsMatch3.0.9
ORrubyonrailsrailsMatch3.0.9rc1
ORrubyonrailsrailsMatch3.0.9rc2
ORrubyonrailsrailsMatch3.0.9rc3
ORrubyonrailsrailsMatch3.0.9rc4
ORrubyonrailsrailsMatch3.0.9rc5
ORrubyonrailsrailsMatch3.0.10
ORrubyonrailsrailsMatch3.0.10rc1
ORrubyonrailsrailsMatch3.0.11
ORrubyonrailsrailsMatch3.0.12
ORrubyonrailsrailsMatch3.0.12rc1
ORrubyonrailsrailsMatch3.0.13
ORrubyonrailsrailsMatch3.0.13rc1
ORrubyonrailsrailsMatch3.0.14
ORrubyonrailsrailsMatch3.0.16
ORrubyonrailsrailsMatch3.0.17
ORrubyonrailsrailsMatch3.0.18
ORrubyonrailsrailsMatch3.0.19
ORrubyonrailsrailsMatch3.0.20
ORrubyonrailsrailsMatch3.1.0
ORrubyonrailsrailsMatch3.1.0beta1
ORrubyonrailsrailsMatch3.1.0rc1
ORrubyonrailsrailsMatch3.1.0rc2
ORrubyonrailsrailsMatch3.1.0rc3
ORrubyonrailsrailsMatch3.1.0rc4
ORrubyonrailsrailsMatch3.1.0rc5
ORrubyonrailsrailsMatch3.1.0rc6
ORrubyonrailsrailsMatch3.1.0rc7
ORrubyonrailsrailsMatch3.1.0rc8
ORrubyonrailsrailsMatch3.1.1
ORrubyonrailsrailsMatch3.1.1rc1
ORrubyonrailsrailsMatch3.1.1rc2
ORrubyonrailsrailsMatch3.1.1rc3
ORrubyonrailsrailsMatch3.1.2
ORrubyonrailsrailsMatch3.1.2rc1
ORrubyonrailsrailsMatch3.1.2rc2
ORrubyonrailsrailsMatch3.1.3
ORrubyonrailsrailsMatch3.1.4
ORrubyonrailsrailsMatch3.1.4rc1
ORrubyonrailsrailsMatch3.1.5
ORrubyonrailsrailsMatch3.1.5rc1
ORrubyonrailsrailsMatch3.1.6
ORrubyonrailsrailsMatch3.1.7
ORrubyonrailsrailsMatch3.1.8
ORrubyonrailsrailsMatch3.1.9
ORrubyonrailsrailsMatch3.1.10
ORrubyonrailsrailsMatch3.2.0
ORrubyonrailsrailsMatch3.2.0rc1
ORrubyonrailsrailsMatch3.2.0rc2
ORrubyonrailsrailsMatch3.2.1
ORrubyonrailsrailsMatch3.2.2
ORrubyonrailsrailsMatch3.2.2rc1
ORrubyonrailsrailsMatch3.2.3
ORrubyonrailsrailsMatch3.2.3rc1
ORrubyonrailsrailsMatch3.2.3rc2
ORrubyonrailsrailsMatch3.2.4
ORrubyonrailsrailsMatch3.2.4rc1
ORrubyonrailsrailsMatch3.2.5
ORrubyonrailsrailsMatch3.2.6
ORrubyonrailsrailsMatch3.2.7
ORrubyonrailsrailsMatch3.2.8
ORrubyonrailsrailsMatch3.2.9
ORrubyonrailsrailsMatch3.2.10
ORrubyonrailsrailsMatch3.2.11
ORrubyonrailsrailsMatch3.2.12
ORrubyonrailsrailsMatch3.2.13
ORrubyonrailsrailsMatch3.2.13rc1
ORrubyonrailsrailsMatch3.2.13rc2
ORrubyonrailsrailsMatch3.2.15
ORrubyonrailsrailsMatch3.2.15rc3
ORrubyonrailsrailsMatch4.0.0-
ORrubyonrailsrailsMatch4.0.0beta
ORrubyonrailsrailsMatch4.0.0rc1
ORrubyonrailsrailsMatch4.0.0rc2
ORrubyonrailsrailsMatch4.0.1-
ORrubyonrailsrailsMatch4.0.1rc1
ORrubyonrailsrailsMatch4.0.1rc2
ORrubyonrailsrailsMatch4.0.1rc3
ORrubyonrailsrailsMatch4.0.1rc4
ORrubyonrailsrailsMatch4.0.2
ORrubyonrailsrailsMatch4.1.0beta1
ORrubyonrailsruby_on_railsRange≤3.2.16
ORrubyonrailsruby_on_railsMatch0.5.0
ORrubyonrailsruby_on_railsMatch0.5.5
ORrubyonrailsruby_on_railsMatch0.5.6
ORrubyonrailsruby_on_railsMatch0.5.7
ORrubyonrailsruby_on_railsMatch0.6.0
ORrubyonrailsruby_on_railsMatch0.6.5
ORrubyonrailsruby_on_railsMatch0.7.0
ORrubyonrailsruby_on_railsMatch0.8.0
ORrubyonrailsruby_on_railsMatch0.8.5
ORrubyonrailsruby_on_railsMatch0.9.0
ORrubyonrailsruby_on_railsMatch3.0.4
ORrubyonrailsruby_on_railsMatch3.2.14
ORrubyonrailsruby_on_railsMatch3.2.14rc1
ORrubyonrailsruby_on_railsMatch3.2.14rc2
ORrubyonrailsruby_on_railsMatch3.2.15rc1
ORrubyonrailsruby_on_railsMatch3.2.15rc2
Node
opensuseopensuseMatch13.1
ORopensuse_projectopensuseMatch12.3
Node
redhatcloudformsMatch3.0
ORredhatenterprise_linuxMatch6.0
References
lists.opensuse.org/opensuse-updates/2014-02/msg00081.html
openwall.com/lists/oss-security/2014/02/18/8
rhn.redhat.com/errata/RHSA-2014-0215.html
rhn.redhat.com/errata/RHSA-2014-0306.html
secunia.com/advisories/57376
www.securityfocus.com/bid/65647
www.securitytracker.com/id/1029782
groups.google.com/forum/message/raw?msg=rubyonrails-security/tfp6gZCtzr4/j8LUHmu7fIEJ
Related
veracode
veracode
Multiple Cross-site Scripting (XSS) Vulnerabilities
2019-01-15 08:58:42
Arbitrary Code Execution
2019-05-02 05:01:21
osv
osv
Rails vulnerable to Cross-site Scripting
2017-10-24 18:33:36
ruby-actionpack-3.2 - security update
2014-05-16 00:00:00
cve
cve
CVE-2014-0081
2014-02-20 15:27:09
ubuntucve
ubuntucve
CVE-2014-0081
2014-02-20 00:00:00
debiancve
debiancve
CVE-2014-0081
2014-02-20 15:27:09
prion
prion
Cross site scripting
2014-02-20 15:27:00
cvelist
cvelist
CVE-2014-0081
2014-02-20 11:00:00
github
github
Rails vulnerable to Cross-site Scripting
2017-10-24 18:33:36
rubygems
rubygems
nessus
nessus
openSUSE Security Update : rubygem-actionpack-3_2 (openSUSE-SU-2014:0295-1)
2014-06-13 00:00:00
CentOS 6 : ruby193-rubygem-actionpack (CESA-2014:0306)
2014-03-18 00:00:00
centos
centos
ruby193 security update
2014-03-17 21:55:16
openvas
openvas
Fedora Update for rubygem-activerecord FEDORA-2014-3169
2014-03-12 00:00:00
Fedora Update for rubygem-activerecord FEDORA-2014-3169
2014-03-12 00:00:00
Mageia: Security Advisory (MGASA-2014-0191)
2022-01-28 00:00:00
fedora
fedora
[SECURITY] Fedora 20 Update: rubygem-activerecord-4.0.0-2.fc20
2014-03-11 04:00:14
[SECURITY] Fedora 20 Update: rubygem-actionpack-4.0.0-3.fc20
2014-03-11 04:00:14
[SECURITY] Fedora 20 Update: rubygem-actionpack-4.0.0-4.fc20
2014-05-23 18:56:34
mageia
mageia
Updated ruby-rails and associated packages fix multiple vulnerabilities
2014-04-24 23:02:23
redhat
redhat
(RHSA-2014:0306) Moderate: ruby193-rubygem-actionpack security update
2014-03-17 00:00:00
(RHSA-2014:0215) Critical: cfme security, bug fix, and enhancement update
2014-03-11 00:00:00
securityvulns
securityvulns
[SECURITY] [DSA 2929-1] ruby-actionpack-3.2 security update
2014-06-14 00:00:00
debian
debian
[SECURITY] [DSA 2929-1] ruby-actionpack-3.2 security update
2014-05-16 08:15:07
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
5.6 Medium
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
59.1%
Related for NVD:CVE-2014-0081