Cross-Site Scripting Vulnerabilities in Ruby on Rails Framework

CVE-2014-0081

What is CVE-2014-0081?

Multiple cross-site scripting vulnerabilities exist within the Ruby on Rails framework, specifically in the number_to_currency, number_to_percentage, and number_to_human helper methods. These vulnerabilities allow remote attackers to inject malicious web scripts or HTML via parameters like format, negative_format, or units. As a result, they can potentially disrupt web application functionality or exploit end-user interactions.

References