Advisory details:
gitlab / gem/rails/CVE-2014-0081
| Advisory ID | gitlab/gem/rails/CVE-2014-0081 |
| Aliases |
CVE-2014-0081
|
| Summary | XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human There is an XSS vulnerability in the `number_to_currency`, `number_to_percentage` and `number_to_human` helpers in Ruby on Rails. These helpers allow users to nicely format a numeric value. Some helper parameters (`format`, `negative_format` and `units`) are not escaped correctly. Applications which pass user controlled data as one of these parameters are vulnerable to an XSS attack. All users passing user controlled data to these parameters of the number helpers should either upgrade or use one of the workarounds immediately. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| cvssv2 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/rails/CVE-2014-0081.yml |
| Reference id | Reference type | URL |
|---|---|---|
| https://groups.google.com/forum/#!topic/rubyonrails-security/tfp6gZCtzr4 |
No exploits are available.
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
There are no SSVC decisions available.