Published: 07/12/2013 Updated: 08/08/2019

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4.x prior to 4.0.2 allows remote malicious users to inject arbitrary web script or HTML via a crafted HTML attribute.

Vulnerable Product	Search on Vulmon	Subscribe to Product
rubyonrails rails 4.0.0
rubyonrails rails 4.0.1
rubyonrails rails

Debian Bug report logs - #731288 ruby-actionpack-32: multiple vulnerabilities [CVE-2013-6414 CVE-2013-4491 CVE-2013-6415 CVE-2013-6417 CVE-2013-6416] Package: ruby-actionpack-32; Maintainer for ruby-actionpack-32 is (unknown); Reported by: Antonio Terceiro <terceiro@debianorg> Date: Wed, 4 Dec 2013 01:09:01 UTC Severi ...

Debian Bug report logs - #731290 ruby-actionpack-40: multiple vulnerabilities [CVE-2013-6414 CVE-2013-4491 CVE-2013-6415 CVE-2013-6417 CVE-2013-6416] Package: ruby-actionpack-40; Maintainer for ruby-actionpack-40 is (unknown); Reported by: Antonio Terceiro <terceiro@debianorg> Date: Wed, 4 Dec 2013 01:09:01 UTC Severi ...

Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helperrb in Ruby on Rails 4x before 402 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute ...

CWE-79 http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/https://groups.google.com/forum/message/raw?msg=ruby-security-ann/5ZI1-H5OoIM/ZNq4FoR2GnIJ http://www.securityfocus.com/bid/64071 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731288 https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2013-6416

CVE-2013-6416

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect