CVE-2014-2538 : Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem

Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack.

Published 2014-03-25 18:21:48

Updated 2015-10-08 14:44:59

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2014-2538

Joshua Peek » Rack-ssl » For Ruby
Versions up to, including, (<=) 1.3.4
cpe:2.3:a:joshua_peek:rack-ssl:*:*:*:*:*:ruby:*:*
Matching versions
Joshua Peek » Rack-ssl » Version: 1.3.1 For Ruby
cpe:2.3:a:joshua_peek:rack-ssl:1.3.1:*:*:*:*:ruby:*:*
Matching versions
Joshua Peek » Rack-ssl » Version: 1.2.0 For Ruby
cpe:2.3:a:joshua_peek:rack-ssl:1.2.0:*:*:*:*:ruby:*:*
Matching versions
Joshua Peek » Rack-ssl » Version: 1.0.0 For Ruby
cpe:2.3:a:joshua_peek:rack-ssl:1.0.0:*:*:*:*:ruby:*:*
Matching versions
Joshua Peek » Rack-ssl » Version: 1.1.0 For Ruby
cpe:2.3:a:joshua_peek:rack-ssl:1.1.0:*:*:*:*:ruby:*:*
Matching versions
Joshua Peek » Rack-ssl » Version: 1.3.0 For Ruby
cpe:2.3:a:joshua_peek:rack-ssl:1.3.0:*:*:*:*:ruby:*:*
Matching versions
Joshua Peek » Rack-ssl » Version: 1.3.2 For Ruby
cpe:2.3:a:joshua_peek:rack-ssl:1.3.2:*:*:*:*:ruby:*:*
Matching versions
Joshua Peek » Rack-ssl » Version: 1.3.3 For Ruby
cpe:2.3:a:joshua_peek:rack-ssl:1.3.3:*:*:*:*:ruby:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2014-2538

EPSS FAQ

0.25%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 62 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-2538

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2014-2538

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-2538

http://www.openwall.com/lists/oss-security/2014/03/19/20

oss-security - Re: CVE Request: rack-ssl rubygem: XSS in error page
http://www.securityfocus.com/bid/66314

RubyGems rack-ssl 'lib/rack/ssl.rb' Cross Site Scripting Vulnerability
http://lists.opensuse.org/opensuse-updates/2014-04/msg00032.html

openSUSE-SU-2014:0515-1: moderate: update for rubygem-rack-ssl
https://github.com/josh/rack-ssl/commit/9d7d7300b907e496db68d89d07fbc2e0df0b487b

Handle bad URIs gracefully. · josh/rack-ssl@9d7d730 · GitHub
Patch

Jump to

Vulnerability Details : CVE-2014-2538

Products affected by CVE-2014-2538

Exploit prediction scoring system (EPSS) score for CVE-2014-2538

CVSS scores for CVE-2014-2538

CWE ids for CVE-2014-2538

References for CVE-2014-2538