PT-2014-3469 · Ruby+2 · Ruby On Rails+2

Published 2014-02-20 · Updated 2019-08-08 · CVE-2014-0081

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions prior to 3.2.17 Ruby on Rails versions 4.0.x prior to 4.0.3 Ruby on Rails versions 4.1.x prior to 4.1.0.beta2

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in Ruby on Rails. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the format, negative format, or units parameter to the number to currency, number to percentage, or number to human helper. The vulnerability arises because some parameters to the helper are not escaped correctly, making applications that pass user-controlled data as one of these parameters vulnerable to an XSS attack.

Recommendations For Ruby on Rails versions prior to 3.2.17, upgrade to version 3.2.17 or later. For Ruby on Rails versions 4.0.x prior to 4.0.3, upgrade to version 4.0.3 or later. For Ruby on Rails versions 4.1.x prior to 4.1.0.beta2, upgrade to version 4.1.0.beta2 or later. As a temporary workaround, consider escaping the value passed to the format, negative format, and units parameters, for example, by replacing params[:format] with h(params[:format]).

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CESA-2014_0306

CVE-2014-0081

DSA-2929-1

GHSA-M46P-GGM5-5J83

MGASA-2014-0191

RHSA-2014:0215

RHSA-2014:0306

SUSE-SU-2014_0457-2

Affected Products

Centos

Ruby On Rails

Suse

References · 26

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2014-0081.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-0081.yml · Exploit
• http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0081 · Security Note
• https://lists.fedoraproject.org/pipermail/package-announce/2014-March/129716.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0306.html · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2014-March/129715.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0215.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0191.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0081 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-0081 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0191 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-0081 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m46p-ggm5-5j83 · Vendor Advisory
• https://github.com/rails/rails · Note