XSS Vulnerability in number_to_currency
Published: December 03, 2013
SECURITY IDENTIFIERS
- CVE: CVE-2013-6415 (NVD)
- GHSA: GHSA-6h5q-96hp-9jgm
- OSVDB: OSVDB-100524
- Vendor Advisory: https://groups.google.com/forum/#!topic/ruby-security-ann/9WiRn2nhfq0
GEM
FRAMEWORK
SEVERITY
CVSS v2.0: 4.3 (Medium)
PATCHED VERSIONS
~> 3.2.16
>= 4.0.2
DESCRIPTION
There is an XSS vulnerability in the number_to_currency helper in Ruby on Raile. The number_to_currency helper allows users to nicely format a numeric value. One of the parameters to the helper (unit) is not escaped correctly. Applications which pass user controlled data as the unit parameter are vulnerable to an XSS attack.