CVE-2013-6416

Description

Cross-site scripting (XSS) vulnerability in the simple_format helper in `actionpack/lib/action_view/helpers/text_helper.rb` in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.

How to fix CVE-2013-6416

To remediate CVE-2013-6416, upgrade the affected package to a fixed version below.

• RubyGems/actionpack—upgrade to 4.0.2 or later

Is CVE-2013-6416 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• >= 4.0.0, < 4.0.2

References (8)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2013-6416
• PATCHgithub.com/rails/rails
• WEBgithub.com/rails/rails/commit/4b4f5847f64f81c961625e647711ef9f6ad1a454
• WEBgithub.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6416.yml