CVE-2013-4491: XSS

Q: What is the severity of CVE-2013-4491?

CVE-2013-4491 is classified as a medium severity vulnerability due to its potential for remote exploitation.

Q: How do I fix CVE-2013-4491?

To mitigate CVE-2013-4491, upgrade your Ruby on Rails to version 3.2.16 or 4.0.2 or later.

Q: What types of attacks can be executed against CVE-2013-4491?

CVE-2013-4491 allows attackers to execute cross-site scripting (XSS) attacks by injecting arbitrary web scripts or HTML.

Q: Which versions of Ruby on Rails are affected by CVE-2013-4491?

CVE-2013-4491 affects Ruby on Rails versions prior to 3.2.16 and 4.0.2.

Q: Is CVE-2013-4491 a common vulnerability?

CVE-2013-4491 is a known vulnerability affecting many applications built on older versions of Ruby on Rails.

Published Dec 7, 2013

Updated

Cross-site scripting (XSS) vulnerability in actionpack/lib/actionview/helpers/translationhelper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string that triggers generation of a fallback string by the i18n gem.

Other sources

Affected Software

110 affected componentsFixes available

rubygems/actionpack>=4.0.0<4.0.2

4.0.2

rubygems/actionpack>=3.0.0<3.2.16

3.2.16

rubyonrails Rails<=4.0.1

rubyonrails Rails=4.0.0

rubyonrails Rails=4.0.0-beta

rubyonrails Rails=4.0.0-rc1

rubyonrails Rails=4.0.0-rc2

rubyonrails Rails=4.0.1-rc1

rubyonrails Rails=3.0.0

rubyonrails Rails=3.0.0-beta

rubyonrails Rails=3.0.0-beta2

rubyonrails Rails=3.0.0-beta3

rubyonrails Rails=3.0.0-beta4

rubyonrails Rails=3.0.0-rc

rubyonrails Rails=3.0.0-rc2

rubyonrails Rails=3.0.1

rubyonrails Rails=3.0.1-pre

rubyonrails Rails=3.0.2

rubyonrails Rails=3.0.2-pre

rubyonrails Rails=3.0.3

rubyonrails Rails=3.0.4-rc1

rubyonrails Rails=3.0.5

rubyonrails Rails=3.0.5-rc1

rubyonrails Rails=3.0.6

rubyonrails Rails=3.0.6-rc1

rubyonrails Rails=3.0.6-rc2

rubyonrails Rails=3.0.7

rubyonrails Rails=3.0.7-rc1

rubyonrails Rails=3.0.7-rc2

rubyonrails Rails=3.0.8

rubyonrails Rails=3.0.8-rc1

rubyonrails Rails=3.0.8-rc2

rubyonrails Rails=3.0.8-rc3

rubyonrails Rails=3.0.8-rc4

rubyonrails Rails=3.0.9

rubyonrails Rails=3.0.9-rc1

rubyonrails Rails=3.0.9-rc2

rubyonrails Rails=3.0.9-rc3

rubyonrails Rails=3.0.9-rc4

rubyonrails Rails=3.0.9-rc5

rubyonrails Rails=3.0.10

rubyonrails Rails=3.0.10-rc1

rubyonrails Rails=3.0.11

rubyonrails Rails=3.0.12

rubyonrails Rails=3.0.12-rc1

rubyonrails Rails=3.0.13

rubyonrails Rails=3.0.13-rc1

rubyonrails Rails=3.0.14

rubyonrails Rails=3.0.16

rubyonrails Rails=3.0.17

rubyonrails Rails=3.0.18

rubyonrails Rails=3.0.19

rubyonrails Rails=3.0.20

rubyonrails Rails=3.1.0

rubyonrails Rails=3.1.0-beta1

rubyonrails Rails=3.1.0-rc1

rubyonrails Rails=3.1.0-rc2

rubyonrails Rails=3.1.0-rc3

rubyonrails Rails=3.1.0-rc4

rubyonrails Rails=3.1.0-rc5

rubyonrails Rails=3.1.0-rc6

rubyonrails Rails=3.1.0-rc7

rubyonrails Rails=3.1.0-rc8

rubyonrails Rails=3.1.1

rubyonrails Rails=3.1.1-rc1

rubyonrails Rails=3.1.1-rc2

rubyonrails Rails=3.1.1-rc3

rubyonrails Rails=3.1.2

rubyonrails Rails=3.1.2-rc1

rubyonrails Rails=3.1.2-rc2

rubyonrails Rails=3.1.3

rubyonrails Rails=3.1.4

rubyonrails Rails=3.1.4-rc1

rubyonrails Rails=3.1.5

rubyonrails Rails=3.1.5-rc1

rubyonrails Rails=3.1.6

rubyonrails Rails=3.1.7

rubyonrails Rails=3.1.8

rubyonrails Rails=3.1.9

rubyonrails Rails=3.1.10

rubyonrails Rails=3.2.0

rubyonrails Rails=3.2.0-rc1

rubyonrails Rails=3.2.0-rc2

rubyonrails Rails=3.2.1

rubyonrails Rails=3.2.2

rubyonrails Rails=3.2.2-rc1

rubyonrails Rails=3.2.3

rubyonrails Rails=3.2.3-rc1

rubyonrails Rails=3.2.3-rc2

rubyonrails Rails=3.2.4

rubyonrails Rails=3.2.4-rc1

rubyonrails Rails=3.2.5

rubyonrails Rails=3.2.6

rubyonrails Rails=3.2.7

rubyonrails Rails=3.2.8

rubyonrails Rails=3.2.9

rubyonrails Rails=3.2.10

rubyonrails Rails=3.2.11

rubyonrails Rails=3.2.12

rubyonrails Rails=3.2.13

rubyonrails Rails=3.2.13-rc1

rubyonrails Rails=3.2.13-rc2

rubyonrails ruby on Rails<=3.2.15

rubyonrails ruby on Rails=3.0.4

rubyonrails ruby on Rails=3.1.11

rubyonrails ruby on Rails=3.2.14

rubyonrails ruby on Rails=3.2.14-rc1

rubyonrails ruby on Rails=3.2.14-rc2

rubyonrails ruby on Rails=3.2.15-rc1

rubyonrails ruby on Rails=3.2.15-rc2

Event History

Dec 7, 2013

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Oct 24, 2017

Advisory Published

06:33 PM

Frequently Asked Questions

What is the severity of CVE-2013-4491?

CVE-2013-4491 is classified as a medium severity vulnerability due to its potential for remote exploitation.

How do I fix CVE-2013-4491?