{"id":"CVE-2014-0081","published":"2014-02-20T11:00:00Z","modified":"2024-08-06T09:05:38Z","title":"Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on…","vendor":null,"product":null,"tier":"tail","description":{"text":"Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.04032,"percentile":0.90558,"provenance":"source"},"cwes":[],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2014-0215.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0306.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/65647","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.securitytracker.com/id/1029782","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://openwall.com/lists/oss-security/2014/02/18/8","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://secunia.com/advisories/57376","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/tfp6gZCtzr4/j8LUHmu7fIEJ","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":18.1,"factors":[{"name":"EPSS percentile","points":18.11}]},"affected":[{"ecosystem":"RubyGems","package":"rails","vulnerableRanges":[">=3.0.0, <3.2.17",">=4.0.0, <4.0.3"],"patched":["3.2.17","4.0.3"],"from":["GHSA-m46p-ggm5-5j83"],"provenance":"source"},{"ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=3.0.0, <3.2.17",">=4.0.0, <4.0.3"],"patched":["3.2.17","4.0.3"],"from":["GHSA-m46p-ggm5-5j83"],"provenance":"source"}],"euvd":{"id":"EUVD-2017-0269","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2013-6415","published":"2013-12-07","fixed":"4.0.2","kev":false},{"cve":"CVE-2013-6416","published":"2013-12-07","fixed":"4.0.2","kev":false},{"cve":"CVE-2013-6417","published":"2013-12-07","fixed":"4.0.2","kev":false},{"cve":"CVE-2014-0081","published":"2014-02-20","fixed":"4.0.3","kev":false},{"cve":"CVE-2014-0130","published":"2014-05-07","fixed":"4.1.1","kev":true,"link":{"from":"CVE-2014-0081","to":"CVE-2014-0130","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"4.0.3","toFixed":"4.0.5","daysApart":76}]}},{"cve":"CVE-2015-7576","published":"2016-02-16","fixed":"4.1.14.1","kev":false},{"cve":"CVE-2016-2097","published":"2016-04-07","fixed":"4.1.14.2","kev":false}],"package":"RubyGems:actionpack"}}