CVE-2014-2538
rack-ssl Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack.
- Record
CVE-2014-2538- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack.
- Record
CVE-2014-2538- Updated
- 2026-11-02
EUVDEUVD-2017-0309 No score
Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack.
- Record
EUVD-2017-0309- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v3rr-cph9-2g2q
rack-ssl Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack.
- Record
GHSA-v3rr-cph9-2g2q- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-v3rr-cph9-2g2q
rack-ssl Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack.
- Record
GHSA-v3rr-cph9-2g2q- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack.
- Record
CVE-2014-2538- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-2538 No score
Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack.
- Record
DEBIAN-CVE-2014-2538- Updated
- 2026-11-02
OSVMGASA-2014-0156 No score
Updated ruby-rack-ssl packages fix CVE-2014-2538
Updated ruby-rack-ssl packages fix security vulnerabilities:
Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack (CVE-2014-2538).
- Record
MGASA-2014-0156- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rack-sslRubyGems |
before 1.4.0 | 1.4.0 |
ruby-rack-sslDebian:12 |
before 1.3.2-4 | 1.3.2-4 |
ruby-rack-sslDebian:13 |
before 1.3.2-4 | 1.3.2-4 |
ruby-rack-sslDebian:14 |
before 1.3.2-4 | 1.3.2-4 |
rack-sslRubyGems |
before 1.4.0, plus listed versions 1.0.01.1.01.2.01.3.01.3.11.3.21.3.31.3.4 |
1.4.0 |
ruby-rack-sslMageia:3 |
before 1.3.2-3.1.mga3 | 1.3.2-3.1.mga3 |
ruby-rack-sslMageia:4 |
before 1.3.3-3.1.mga4 | 1.3.3-3.1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-2538 is a medium vulnerability (CVSS 4.3) in Joshua Peek Rack-ssl, published March 25, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.19%, the 82nd percentile. Fixed in rack-ssl 1.4.0.
References
openwall.com/lists/oss-security/2014/03/19/20
github.com/josh/rack-ssl/commit/9d7d7300b907e496db68d89d07fbc2e0df0b487b
securityfocus.com/bid/66314
lists.opensuse.org/opensuse-updates/2014-04/msg00032.html
secunia.com/advisories/57466
nvd.nist.gov/vuln/detail/CVE-2014-2538
Show 9 moreShow less
web.archive.org/web/20140524002455/http://secunia.com/advisories/57466
security-tracker.debian.org/tracker/CVE-2014-2538
advisories.mageia.org/MGASA-2014-0156.html
lists.fedoraproject.org/pipermail/package-announce/2014-April/130990.html
bugs.mageia.org/show_bug.cgi?id=13135