medium4.3

CVE-2013-6415

actionpack vulnerable to Cross-site Scripting

Impact

Cross-site scripting (XSS) vulnerability in the `number_to_currency` helper in `actionpack/lib/action_view/helpers/number_helper.rb` in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter.

Affected packages

Ecosystem	Package	Affected	Fixed in
rubygems	`actionpack`	>= 3.0.0, < 3.2.16	3.2.16

Affected products

Vendor	Product	Affected versions
Rubyonrails	Rails	Versions 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5
Rubyonrails	Ruby On Rails	through 3.2.15 Versions 3.0.4, 3.1.11, 3.2.14, 3.2.15

Weakness classification

CWE-79

References

NVD record
CVE.org record
GitHub advisory
http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html
http://lists.opensuse.org/opensuse-updates/2013-12/msg00080.html
http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html
http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html
http://rhn.redhat.com/errata/RHSA-2013-1794.html
http://rhn.redhat.com/errata/RHSA-2014-0008.html
http://rhn.redhat.com/errata/RHSA-2014-1863.html
http://secunia.com/advisories/56093
http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
http://www.debian.org/security/2014/dsa-2888
http://www.securityfocus.com/bid/64077
https://groups.google.com/forum/message/raw?msg=ruby-security-ann/9WiRn2nhfq0/2K2KRB4LwCMJ
https://puppet.com/security/cve/cve-2013-6415
https://github.com/advisories/GHSA-6h5q-96hp-9jgm
https://nvd.nist.gov/vuln/detail/CVE-2013-6415
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6415.yml
https://groups.google.com/forum/#!topic/ruby-security-ann/9WiRn2nhfq0
https://web.archive.org/web/20131206180005/http://www.securityfocus.com/bid/64077